diff --git a/.config/captive-browser.dump-dns.sh b/.config/captive-browser.dump-dns.sh
new file mode 100755
index 0000000..e6a9b1b
--- /dev/null
+++ b/.config/captive-browser.dump-dns.sh
@@ -0,0 +1,2 @@
+#!/bin/sh
+echo "$dns"
diff --git a/.config/captive-browser.toml b/.config/captive-browser.toml
new file mode 100644
index 0000000..2cb244c
--- /dev/null
+++ b/.config/captive-browser.toml
@@ -0,0 +1,27 @@
+# browser is the shell (/bin/sh) command executed once the proxy starts.
+# When browser exits, the proxy exits. An extra env var PROXY is available.
+#
+# Here, we use a separate Chrome instance in Incognito mode, so that
+# it can run (and be waited for) alongside the default one, and that
+# it maintains no state across runs. To configure this browser open a
+# normal window in it, settings will be preserved.
+browser = """
+    chromium-browser \
+    --user-data-dir="$HOME/.chromium-captive" \
+    --proxy-server="socks5://$PROXY" \
+    --host-resolver-rules="MAP * ~NOTFOUND , EXCLUDE localhost" \
+    --no-first-run --new-window --incognito \
+    http://example.com
+"""
+
+# dhcp-dns is the shell (/bin/sh) command executed to obtain the DHCP
+# DNS server address. The first match of an IPv4 regex is used.
+# IPv4 only, because let's be real, it's a captive portal.
+#
+# `wlan0` is your network interface.
+#
+dhcp-dns = "doas udhcpc -i wlan0 -s ~/.config/captive-browser.dump-dns.sh"
+
+# socks5-addr is the listen address for the SOCKS5 proxy server.
+socks5-addr = "localhost:1666"
+