The basic premise comes down to this: If you can connect to a wireless access point that has a captive portal running, constantly forwarding your web requests to a payment page, you can most likely bypass those restrictions if you can get name resolution.
Simply open a shell and ping your favorite website. It doesn’t matter if you get ICMP packets back, what you’re looking for is name resolution. If ping says “Pinging www.l.google.com [126.96.36.199]” or similar you should be all set to tunnel your traffic over DNS
In order to get going you’ll need a domain, or sub-domain, a set of Perl scripts called Ozyman, a server to run the ozyman and ssh daemons on, and a little luck
Full step by step instructions can be found at Mubix’s wonderful blog o goodness at Room362.com.