Oh yeah, and if anyone in Iran wants to test it you can use my vps to test. 'ssh -o ProxyCommand="proxytunnel -p syw4e.info:80 -d syw4e.info:22" -v'. See if it does an SSH handshake. If it does, you can use this tunneling method. Also try the icmp/dns/openvpn, though. To see if DNS is not being intercepted, run 'dig +short www.google.com @syw4e.info' (or 'nslookup www.google.com syw4e.info' from windows). If it returns "127.0.0.1", you were communicating directly with my nameserver and you should be able to tunnel openvpn to a remote box on port 53.

I'll have to find the paper and clean it up a bit, but e-mail me and i'll send it when I find it and i'll post it on here. It's not amazing or anything, mostly just a talk with references to tools and articles and common flaws in captive portals.