Technology

Unless the whole of the inner IP packet is encrypted,

It is, because they're inside an encrypted stream of data.

The way OpenVPN works is this:

1. OpenVPN establishes a TLS connection to the OpenVPN server.

2. Your computer's kernel generates an IP packet.

3. OpenVPN sucks that up, shoves it into the TLS connection. That connection is encrypted, so the network provider cannot see inside it, know whether the data is IP packets or anything else, though I suppose maybe traffic analysis might let one classify a connection as probably being a VPN.

4. The data in that connection is broken up into IP packets, went to the OpenVPN server.

5. The OpenVPN server decrypts the data in the TLS stream, pulls the original IP packets out.

So the original packets are always encrypted when the network sees them. Only the OpenVPN server can see the unencrypted packet you originally sent.

What @raltoid is saying sounds plausible, though I can't confirm it myself off-the-cuff -- that OpenVPN is detected by looking at somehing unique in the initial handshake.