Okay, despite the odds (for someone like me :-), it actually works !

I just tried three captive networks around my workplace at lunch time, and got a successful "iodine handshake" each time -- meaning client, server, domain delegation and router/firewall/NAT are all set up properly, which is a minor miracle in and of itself :-)

The first two, Swissair (Hilton hotel) and SFR (local Vodafone) would not load the web page at the other end of the tunnel by IP address. I don't know if this is due to crippled DNS or marginal Wifi signal. But the local Starbucks had a strong signal and let me see the web pages perfectly. Yay...

Actually it was faster than I expected -- not something you'd browse your Flickr collection with, but certainly good enough for text-based browsing and webmail.

Now I need to set up asinus' script on the tablet, and configure forwarding/routing/NAT on my server so that I can actually see something else than my own web site... I have a feeling this is going to be the messiest part of all (except if it's already in the Howto :-).