How to restrict ingress traffic only to 443 UDP via `aws_security_group` to VPN Client endpoint?

Question

I was tried to follow this and this instructions to restrict traffic to Client VPN endpoint only to 443 port

resource "aws_security_group" "vpn_secgroup" {
  name   = "vpn-sg"
  vpc_id = module.vpc.vpc_id
  description = "Allow inbound traffic from port 443, to the VPN"
 
  ingress {
   protocol         = "tcp"
   from_port        = 443
   to_port          = 443
   cidr_blocks      = ["0.0.0.0/0"]
   ipv6_cidr_blocks = ["::/0"]
  }
 
  egress {
   protocol         = "-1"
   from_port        = 0
   to_port          = 0
   cidr_blocks      = ["0.0.0.0/0"]
   ipv6_cidr_blocks = ["::/0"]
  }
}

I can connect to this VPN endpoint openvpn --config conf.ovpn.

To check that this rule applied, I changed 443 port to 700 and applied new configuration. But I still can connect to my VPN Client endpoint.

How to restric traffic only to 443 UDP port? What did I miss?