VPN-support.md

@@ -172,3 +172,16 @@ So passing it on a USB stick would work. Obviously, you could put it into Tails'
  - reboot, enable both persistent storage and vpn
  - you can now pick your file from some UI
 
+#### Q: What about Unsafe Browser and captive portals?
+
+The easiest option is to make the Unsafe Browser become the VPN browser. This means there is no way of passing
+captive portals.
+
+If we wanted to make captive portal work, we'd have 2 options:
+
+ 1. create one more browser, with one more network namespace (say, "vpnbrowser"). The clearnet browser has
+    the same fwmark set that wireguard is setting, so it ignores the `main` routing table.
+
+ 2. the unsafe browser becomes the VPN browser after the VPN has been started
+
+