Ultrasurf connection might be using random ports and trying to go out to Internet directly.
WSA is only listen to HTTP/HTTPS that RFC complaints if the traffics are not using those, WSA might not be able to process them.
Best take packet capture from client side that generating ultrasurf request to see the packets and if the connections are true trying to go out directly then blocking those connections from firewall is the best bet.
