UDP is perferred for VPNs, the overhead is lower. This discussion about unreliability of UDP is moot. Since we're tunelling, there's no difference between a TCP datagram lost on the open internet and a TCP datagram lost in a TCP tunnel or a TCP datagram lost in a UDP tunnel. All will be retransmitted.
A problem with UDP tunnels are that they're stateless, this makes it harder to secure at the firewall. Reply packets are no different than source packets. From a security perspective, TCP tunnels are easier.
