I used to use iodine, a tunneling server which uses DNS as the transport, which would work even through captive portals at the time.

https://github.com/yarrick/iodine