OnionCat is a Tor-based decentralized peer-to-peer VPN. It acts like a single IPv6 subnet hidden inside Tor permitting a hidden service to be transformed into an IPv6 address on the subnet. In BSD land this shows up as a tun(4) device. One can do udp (dns, nfs, etc) or tcp or even IPSec between OnionCat instances (and only between OnionCat instances; not out ...
I try an alternative simplistic explanation.
You need to set up a hidden service.
Your partner needs to set up a hidden service.
connects from hidden service to hidden service.
provides an IPv6 for you
provides an IPv6 for your partner
Now you can use IPv6, TCP and UDP with your partner.
What is OnionCat NOT:
A magic way to let you connect ...
It might work. Tor transports TCP and as you can do OpenVPN over TCP, you can do OpenVPN over Tor.
Other places document how to bond two tun devices, for instance openvpn bond 2 tap tunnels on stackoverflow.
So, while it could work, I'm not sure if it's worth the trouble and network overhead. Probably depends on what you want from your VPN.
I don't know ...
So my question is, how does Tor do that?
How can you find websites that doesn't have any links pointing to it?
At best, either brute-force guessing or some information leak outside of links from another web page.
Depending on how much unguessable information is in the link, this could be infeasible.
If such systems were implemented, would the networking overhead be unworkably large?
Speculating here: Tor's scaling survived the botnet attack and all those clients created hidden services to communicate with each other, no?
Such systems would facilitate high-throughput abuse of Tor.
How could that threat be mitigated?
As last resort, ...