T-Mobile's tethering block works like this: They sniff your unencrypted HTTP traffic for user agents that look like they came from a Windows machine, and if they find one they hijack the connection and redirect you to their tethering upsell page. They can't sniff HTTPS connections, so HTTPS continues to work. For HTTP you can change your user agent, or just use a Mac (which their sniffer isn't smart enough to detect, yet).
If their sniffer becomes smarter in the future you can always switch to a VPN for your tethering traffic, which they wouldn't be able to distinguish from a VPN connection made by the phone itself.
Ultimately, as long as you have full control over your phone they can't stop you from doing what you like with the data you're paying for. Of course, I wouldn't recommend relying on routine tethering without paying your carrier for it, but it's really nice to have on occasion.
If their sniffer becomes smarter in the future you can always switch to a VPN for your tethering traffic, which they wouldn't be able to distinguish from a VPN connection made by the phone itself.
Ultimately, as long as you have full control over your phone they can't stop you from doing what you like with the data you're paying for. Of course, I wouldn't recommend relying on routine tethering without paying your carrier for it, but it's really nice to have on occasion.