Set up virtual private networks (VPNs)

Your Chromebook tin can connect to a private network, similar the network at your work or schoolhouse, with a Virtual Individual Network (VPN) connection.

Tip: If you apply your Chromebook at piece of work or school and have problems with your VPN, contact your administrator for more help.

IKEv2 VPN support

Your Chromebook has built-in support for VPNs that use Internet Key Commutation version 2 (IKEv2). It'll either use a pre-shared key (PSK), user certificates, or Extensible Authentication Protocol (EAP) with a username and countersign to gear up the secure tunnel.

  1. At the bottom right, select the time.
  2. Select Settings.
  3. In the "Network" department, select Add connection.
  4. Next to "Add built-in VPN," select Add .
  5. In the box that opens, fill in the info. If you lot use your Chromebook at piece of work or school, you might need to go this information from your administrator.
    • Server proper name: You tin name your connexion whatever you'd similar. For example, "Work VPN."
    • Provider type: Select IPsec (IKEv2).
    • Server hostname: Either the IP accost or the full server hostname.
    • Authentication type: Choose either Pre-shared key, User certificate, or Username and password.
    • Username, Countersign: For EAP connections only. Each VPN user should accept their own unique username and password.
    • Pre-shared fundamental: For PSK connections only. This key isn't your personal password, but a passphrase or key used in the IPsec configuration. In a typical set-up, everyone who connects to the aforementioned VPN server uses the same PSK.
    • Server CA certificate: For user document connections and EAP connections just. From the list, select your installed certificate authorisation document. The server'southward certificate gets checked to make sure that it was signed past the correct certificate authority (CA).
    • User document: For user certificate connections only. From the list, select your installed user VPN document. If you don't have any certificates installed, you lot'll receive an error message. Learn how to install a document.
    • Local identity and Remote identity: If your VPN provider has instructions for these fields, fill up them in here. If you're non sure, leave these fields empty.
  6. Select Connect.

L2TP/IPsec VPN support

Your Chromebook has built-in back up for VPNs that use L2TP over IPsec. The IPsec layer volition either use a pre-shared primal (PSK) or user certificates to ready upwards the secure tunnel. The L2TP layer requires a username and countersign.

Tip: Cisco ASA devices can be set up to back up L2TP over IPSec. Learn how to set up a Cisco ASA device.

  1. At the lesser correct, select the time.
  2. Select Settings .
  3. In the "Network" section, select Add connectedness.
  4. Next to "Add together built-in VPN," select Add .
  5. In the box that opens, fill in the info. If you use your Chromebook at work or school, you might need to get this information from your ambassador.
    • Service name: Y'all can name your connection any yous like. For case, "Work VPN."
    • Provider type: Select L2TP/IPsec.
    • Server hostname: Enter either the IP address or the total server hostname.
    • Hallmark blazon: Select Pre-shared primal or User certificate .
    • Username and Password: Your L2TP/PPP credentials. Each VPN user should have their own unique username and password.
    • Group proper noun: The client'southward IPsec identity field, which some VPN servers utilize to gear up the Tunnel Group or User Realm. If you're not sure, leave this field empty.
    • Pre-shared key: For PSK connections only. This key isn't your personal countersign, but a passphrase or key used in the IPsec configuration. In a typical set-up, anybody who connects to the aforementioned VPN server uses the same PSK.
    • Server CA certificate: For user certificate connections only. From the list, select your installed certificate say-so certificate. The server'due south certificate gets checked to make certain that it was signed by the correct certificate authorisation (CA).
    • User certificate: For user certificate connections but. From the list, select your installed user VPN certificate. If yous don't take any certificates installed, you receive an mistake message. Acquire how to install a document.
  6. Select Connect.

OpenVPN support

Your Chromebook has bones support for OpenVPN servers. OpenVPN connections can employ username/countersign authentication, client document authentication, or a combination of both.

If you need to set up more advanced features of OpenVPN or import an ".ovpn" configuration file, and your Chromebook supports the Play Store, consider installing OpenVPN for Android instead of using the built-in OpenVPN customer.

  1. At the bottom right, select the time.
  2. Select Settings .
  3. In the "Network" department, select Add connection.
  4. Side by side to OpenVPN / L2TP, select Add .
  5. In the box that opens, fill in the info. If y'all utilize your Chromebook at work or school, you lot might need to get this information from your ambassador.
    • Service name: Y'all can name your connections any you lot'd similar. For case, "Work VPN."
    • Provider type: Select OpenVPN.
    • Server hostname: Enter either the IP address or the full server hostname.
    • Username and password: Your VPN credentials. This tin can be left blank if your server only uses client certificate hallmark.
    • OTP: If you take a one-time password (OTP) card or VPN token that generates 1-time passwords, get a password and enter it here. In almost cases, go out information technology blank.
    • Server CA document: From the listing, select your installed certificate authority document. The server'southward certificate gets checked to make sure that it was signed past the correct certificate authority (CA). If yous accept trouble with your server certificate, you can select Don't check to skip CA validation, but this skips an of import security mensurate.
    • User certificate: If your VPN server requires client certificate authentication, select your installed user VPN certificate from the listing. Learn how to install a document.
  6. Select Connect.

WireGuard support

Some Chromebooks accept bones built-in support for the WireGuard protocol.

  1. At the bottom right, select the time.
  2. Select Settings .
  3. In the "Network" department, select Add connection.
  4. Next to "OpenVPN / L2TP," select Add .
  5. In the box that opens, fill in the info.
    • Service name: You tin can name your connection whatsoever you'd like. For example: "Work VPN."
    • Provider blazon: Select WireGuard.
    • Client IP address: This is the IP accost you use with the Chromebook.
    • Proper noun servers: The proper noun server IPs for the network.
    • Key: Select I have a keypair if you have a keypair from the provider, or Generate random keypair if yous want to generate them. You can find the generated public cardinal in the network details page later on the WireGuard network connects.
    • Peer public key, pre-shared key, endpoint, allowed IPs, and persistent keepalive interval: Fill in the corresponding data of the WireGuard server.
  6. Select Connect.

PPTP VPN support

Chromebooks with the Play Store tin can connect to PPTP VPN services.

  1. At the bottom right, select the time.
  2. Select Settings.
  3. Scroll downwardly and selectGoogle Play Store.
  4. SelectManage Android Preferences.
  5. Ringlet downwardly and selectPPTP VPN.
  6. In the upper right, select Add .
  7. In the box that appears, fill up in the info. If you're using your Chromebook with an organization, you might need to become this information from your administrator.
    • Name: This can exist anything yous want to name this connection. For example: "Work VPN."
    • Server accost: The proper noun of the server you need to connect with to access your VPN. This tin can either be the IP address or the full server hostname.
    • PPP encryption (MPPE): Go out this checked unless your administrator says otherwise.
    • Prove avant-garde options: Leave this unchecked unless your administrator says otherwise.
    • Username and password: Your VPN credentials. Each VPN user should accept their ain unique username and password.
  8. SelectSalve.

To connect to a PPTP VPN, get to the PPTP VPN menu and select the proper name of the VPN connection.

Notation: Currently, the Google Play Store is only available for some Chromebooks. Larn which Chromebooks support Android apps.

Android VPN apps

Chromebooks with the Play Store can install Android VPN apps.

Important: Currently, the Google Play Shop is merely available for some Chromebooks. Learn which Chromebooks support Android apps.

To create a new connexion or to connect to a VPN provided by an Android app:

Step 1: Install an Android VPN app on your Chromebook

  1. In the corner of your screen, select the Launcher .
  2. Select Play Shop Google Play.
  3. Search for the VPN app you want to install.
  4. Select the VPN app.
  5. On the right, select Install.

Step 2: Configure the VPN app to your Chromebook

  1. At the bottom right, select the time.
  2. Select Settings .
  3. In the "Network" section, select Add connection.
  4. Adjacent to a connection, select Add [app name]... .
  5. Follow the onscreen instructions.

Step 3: Keep your VPN connection on

Some VPNs tin can ever stay connected unless your VPN connectedness stops.

  1. Make sure yous configured a VPN app to your Chromebook.
  2. At the bottom correct, select the fourth dimension.
  3. Select Settings .
  4. On the left panel, select Apps.
  5. Under "Apps," select Google Play Store.
  6. Select Manage Android preferences.
  7. In the window that appears, select Network & cyberspace.
  8. Select VPN. Your VPN app should now exist listed.
  9. To the right of your app, select Settings .
  10. Plough on Always-on VPN. If your Always-on VPN connection stops, you get a notification that stays on until you reconnect. To clear the notification, turn off that specific Always-on VPN.

Tip: If your VPN connection stops and you lot don't desire to connect straight to the net, plow on Cake connections without VPN.

Split tunnel & full tunnel

Typically VPNs implement a full tunnel, which means that all traffic from all Chrome windows, Chrome apps, and Android apps will pass through the VPN connexion. Sometimes you'll desire to utilize a split up tunnel so that merely certain sites will be accessed through the tunnel, while other traffic will skip the VPN and employ your Chromebook'south physical network connection instead. This is useful if:

  • Your VPN only provides access to internal sites, but not full internet admission.
  • You lot need to communicate with devices on your local network, such as printers, while continued to the VPN.

Many Chrome and Android VPN apps, and the built-in OpenVPN customer, tin be ready to use carve up tunnel mode. For assistance setting this up, enquire your administrator.

Install certificates

You might need certificates to connect to a VPN, WPA2 Enterprise network, like EAP-TLS, or a website that requires mutual TLS authentication. If so, your administrator might enquire you lot to visit a special website while continued straight to your organization's network, or download and install the certificates directly yourself.

You'll need:

  • A server certificate that's for everyone at your organization
  • A user certificate that is specific to yous

Install your server certificate

  1. Download your server certificate, co-ordinate to the steps your ambassador gives you.
  2. Open a new tab in Chrome Chrome.
  3. In the address bar, enter chrome://settings/certificates
  4. Select the Authorities tab.
  5. SelectImport and choose the X.509 certificate file, which is usually a file with a .pem, .der, .crt, or .p7b extension.
  6. In the box that appears, fill out the info. None of these settings need to be turned on, then we recommend that you leave these unchecked.
  7. The certificate will open and install itself on your Chromebook.

Install your user certificate

  1. Download your user certificate, according to the steps your administrator gives you. Your certificate filename should terminate with .pfx or .p12.
  2. Open a new tab in Chrome Chrome.
  3. In the address bar, enter chrome://settings/certificates
  4. SelectYour certificates.
  5. SelectImport and Bind.
  6. In the box that opens, select the certificate file and selectOpen up.
  7. When prompted, enter the password for your certificate. If you lot don't know the password, contact your network administrator. If you don't have a password, selectOK.
  8. The certificate volition open and install itself on your Chromebook.

Chromebooks only support RSA client certificates for authenticating to VPNs or EAP wireless networks. ECC client certificates aren't supported.

Related articles

  • If you're a network administrator, assistance your users install user certificates at scale with an extension.
  • Set up VPN on a Cisco ASA device
  • Fix DNS issues

Was this helpful?

How can we improve it?