VPN on a Chromebook: three ways, ranked
A Chromebook has three options. An Android VPN app from the Play Store covers most traffic and is the easiest. The built-in client under network settings handles WireGuard and OpenVPN configurations directly. A Chrome extension proxies only the browser and leaves everything else untouched.
5 min read
ChromeOS is three operating environments in a trench coat: the browser, an Android container and a Linux container. A VPN can be installed into any of them, and which one you choose decides what is actually covered. That is the whole of the complexity here.
Option one: an Android VPN app
Install the provider's app from the Play Store on the Chromebook.
This is the route most people want. It uses Android's VpnService, and on
ChromeOS the system routes browser traffic through it as well as Android app
traffic, so the coverage is close to a system tunnel.
- Covers the browser, Android apps and most system traffic.
- Does not always cover the Linux container, depending on the ChromeOS version and how the container's networking is configured.
- Easiest to set up: install, approve the prompt, connect.
Option two: the built-in client
ChromeOS has its own VPN support under Settings, Network, Add connection, Add built-in VPN. Recent versions handle WireGuard directly in addition to the older L2TP/IPsec and OpenVPN support.
- Covers everything the system routes, which is the most complete of the three.
- Needs the connection details by hand: private key, address, server public key, endpoint and allowed IPs for WireGuard, or an ONC file for OpenVPN.
- Survives sign-out and works before any app has started, which the Android route does not.
If your Chromebook is old enough to lack the WireGuard option, the menu will only show L2TP/IPsec and OpenVPN. That is a version limit rather than a configuration problem.
Option three: a Chrome extension
Install the provider's extension and it proxies the browser.
- Covers Chrome only. Not Android apps, not the Linux container, not system updates.
- Useful on a managed device where you cannot install anything else, and for per-tab control alongside one of the above.
- Not sufficient as the only protection on an untrusted network.
Which to pick
| Situation | Route |
|---|---|
| Personal Chromebook, want it simple | Android app |
| Want coverage before sign-in, or the most complete tunnel | Built-in client |
| Managed school or work device with restrictions | Extension, if permitted |
| Using the Linux container for development | Built-in client |
Managed Chromebooks
School and workplace Chromebooks are enrolled, and the administrator controls what may be installed. Commonly the Play Store is disabled, extension installation is restricted to an allow-list, and adding a network configuration is blocked outright.
If all three are blocked, there is no route, and that is the intended outcome rather than a problem to route around. The device belongs to the organisation and its network policy applies to it.
The Linux container caveat
Crostini, the Linux container, has its own virtual network. Depending on the ChromeOS release, an Android VPN app may or may not cover traffic originating inside it. The built-in client generally does, because it operates a level lower.
If you develop on your Chromebook and the tunnel matters for that work, test it explicitly: run a lookup of your address from inside the container and compare it with what the browser reports. Do not assume the two match.
Confirm it works
Open what is my IP in the browser and check the address and country. Then, if you use Android apps or the Linux container for anything that matters, check from those too. The three environments can disagree, and the only way to know which are covered is to look from each of them.
The Chromebook page covers VPNmine's setup for the Android app and the built-in client, and the Chrome extension is the browser-only option.
One thing to turn on
Whichever route you choose, find the reconnect-on-wake setting. Chromebooks suspend aggressively when the lid closes, and a tunnel that does not come back up leaves the browser working normally and unprotected — the worst combination, because nothing about the experience tells you anything changed.
Entering a WireGuard configuration by hand
The built-in client asks for the fields the protocol needs, and a provider's config file contains all of them. Mapping one to the other:
- Private key comes from the
[Interface]section'sPrivateKey. - IP addresses is the
Addressline, usually a single/32. - Name servers is the
DNSline. Leave it set rather than blank, or lookups keep going to whatever the network handed you. - Public key, preshared key and endpoint all come from the
[Peer]section. - Allowed IPs should be
0.0.0.0/0, ::/0for a full tunnel.
Save it and the connection appears alongside your Wi-Fi networks. Toggling it is then one click from the system tray, and it reconnects at sign-in if you set it to.
Where ChromeOS leaks
Two behaviours are worth knowing about, and neither is a fault as such.
Chrome's secure DNS can send lookups to its own resolver over HTTPS, independently of what the VPN configured. It is under Settings, Privacy and security, Use secure DNS. Encrypted, but not going where the tunnel intended.
Captive portal detection runs before the tunnel comes up, by design, because otherwise a Chromebook could never sign in to a hotel network. That request goes out in the clear every time you join a network. It reveals nothing but the fact that a Chromebook joined, which is a reasonable trade for being able to use the network at all.
