Chromebooks, and all Chrome OS devices, have a lot going for them in terms of security. Installing malware on them is devilishly tricky, and wiping them to start over from scratch is a snap. But there’s one key area in which Chrome OS can be a headache, and that’s VPN support. If you ever wanted to secure your connection with a VPN, but struggled to make it work on your Chromebook, you’re not alone. We’ll explain why it’s a problem, as well as ways to (maybe) fix it.
Does Your Chromebook Need a VPN?
A VPN, or virtual private network, creates an encrypted tunnel between your Chromebook and a server operated by a VPN company. By passing your internet traffic through that tunnel, you ensure it cannot be spied on in transit. You need a VPN because when it’s active, anyone on the same network as you, anyone that can access that network’s router, your ISP, and sneaky intelligence agents will all be kept in the dark. This is most critical on public Wi-Fi networks, but it’s important in every context.
Once your data reaches the VPN server, it’s no longer encrypted. But because it appears to be coming from the VPN server and not your computer (or smartphone), your IP address is hidden. It’s also much harder to correlate online activities directly to you. Plus, if you’re connecting to HTTPS sites, your data will be encrypted at every step of your web browsing.
You can also use a VPN to spoof your location. Just connect to a VPN server in a far-flung locale and all of a sudden your web traffic appears to be coming from the other side of the globe. This is useful for tunneling past repressive online censorship or just tricking a streaming service into letting you watch movies from a different part of the world. That said, using Netflix with a VPN can be difficult, because the company works hard to block VPNs. Note that using a VPN in these ways may break terms of services you’ve agreed to, and even local laws.
What’s the Best Way to Set Up a VPN on a Chromebook?
Broadly speaking, there are three ways to get your Chromebook protected by a VPN: You can use a Chrome browser extension, use an Android app, or manually configure the client in Chrome OS to use the VPN of your choice. Surprisingly, going the Android route is probably your best option. Each method, however, has potential drawbacks, ranging from a lack of support to a lack of documentation, as I’ll explain.
Chrome VPN Extensions
Using a Chrome browser extension is probably the easiest way to secure your web traffic. Many VPN services (including Editors’ Choice winners NordVPN, Private Internet Access, and TunnelBear) offer browser extensions for Chrome. Just install one from the Chrome Extensions Webstore and it will appear alongside your omnibox wherever you’re logged into Chrome.
The downside is that Chrome VPN extensions secure only your web browser traffic. Web traffic from all apps on your Chromebook won’t enjoy the security provided by VPNs. Sometimes, that’s a good thing. If you want to secure your web traffic but don’t want your VPN to screw up your video streaming, you can protect the browser and use, say, an Android app for viewing Netflix that won’t be piped through the VPN. But this can also create confusion about what is and what isn’t secure on your device. In general, we advise people to use a VPN as often, and as broadly as possible.
Android VPN Apps
The best way to secure your Chromebook’s web traffic is to use an Android VPN app on your Chromebook. Running a smartphone app on a laptop may sound a little nuts, but more and more Chromebooks are supporting Android apps, giving you the full fruits of the Google Play store. Just download the VPN app of your choice, log in, and switch it on. Handily, Android VPN apps appear as connection options in the network settings menu on your Chromebook.
There’s a lot of confusion as to whether or not Android VPN apps actually secure all of your Chromebook’s web traffic or just the traffic of other Android apps. However, Google has confirmed to me that Android VPN apps do, in fact, secure everything on you Chromebook. That’s great news, because it is by far the easiest way to set up a VPN on your Chromebook.
Several VPN companies that I have spoken to for this piece, however, are under the impression that this is not always the case. This only adds to the confusion surrounding Chromebooks, and Android apps on Chromebooks. It seem that at one point, Android VPN apps may not have secured all Chrome OS web traffic, and that people may not realize that they do now.
Adding to that confusion is the fact that not all Chromebooks can, or ever will, run Android apps. There’s a growing list of Chrome OS devices that will support the Google Play store, but if yours isn’t on there, you’re out of luck. If yours is on the list, you’ll need to be running the latest version of Chrome OS and activate the Google Play store from the Chrome OS settings menu. Just open the Settings app, search for Google Play, and toggle it on. If you’re using a corporate Google account, however, you may not be able to activate Google Play without approval from your system administrator.
While the Android VPN app situation is the best option, manual configuration is second-best—and may be your only option, if your Chromebook doesn’t support Android apps. Doing so requires a bit of legwork, much of which would be handled by a VPN app if you were on macOS or Windows. It’s about equivalent to manually setting up a VPN on Windows, if you’ve ever tried that.
Unfortunately, it’s not just the legwork that’s the problem with manually configuring your Chromebook. It turns out that several VPN services simply won’t work with Chrome OS. And those that do require you to use a less secure method of connection, as I’ll show.
You have two options for manually setting up a VPN connection on a Chromebook: OpenVPN and L2TP/IPSec. These are both VPN protocols, which are different styles of creating a VPN connection. OpenVPN is my preferred protocol. Because it’s open-source, it’s been picked over for any potential vulnerabilities. Plus, it has a reputation for being fast and reliable.
Unfortunately, you probably won’t be able to successfully create an OpenVPN connection on your Chromebook. When manually configuring an OpenVPN connection, I found that my connection would time out, or that Chrome OS would simply not accept my credentials. A representative from TorGuard suggested that Chrome OS requires OpenVPN to operate with compression disabled, which isn’t an option with VPN services. In the case of TorGuard, I was eventually able to successfully connect via OpenVPN, but it required a lot more configuration than most people might expect.
What about L2TP/IPSec? That protocol is nearly two decades old, and several VPN companies have told me that they don’t consider it secure. In fact, I found several pages of documentation from different VPN services warning against using this protocol, even while they provided instructions on how to configure your Chromebook to use it. When I asked TorGuard about it, a representative said that the company is already planning to phase out its use. That’s in line with most other VPN companies, many of which include L2TP and PPTP only for legacy support. These protocols work, but I don’t recommend using them unless you absolutely must.
For a step-by-step guide to the procedure, see the “Manually Configuring Your Chromebook’s VPN” section below.
Chrome OS VPN Apps
There is another option for getting your Chromebook online with a VPN, and that’s with Chrome OS apps. Chrome Apps used to live alongside Chrome Extensions and were accessible anywhere the Chrome browser lived, but were retired in 2016 due to lack of interest. Most Chrome apps you encounter today are actually progressive web apps, but Chrome OS still supports dedicated apps even if they’ve died out on other platforms.
The upshot is that you download an app that configures your Chromebook to connect via VPN. As with the manual option, you switch the VPN on and off from the network menu built into Chrome OS, not from the app. The app is simply there to set things up for you, just as you set up your VPN connection using a VPN app on Windows or macOS.
The catch is that most consumer VPN companies don’t provide Chrome OS apps. Instead, it’s enterprise grade software solutions like Cisco AnyConnect and PulseSecure. If you have a Chromebook from work, or have ever needed to connect to a work network on your Chromebook, this is probably what you’ve used.
TorGuard offers a handful of servers that work with the aforementioned Cisco AnyConnect environment. Just download the free Cisco AnyConnect Chrome OS app, enter the name of a TorGuard AnyConnect server into the app, and you’re ready to get online. Click your user icon in the lower right corner, select the AnyConnect configuration, and enter your credentials in the windows that appear.
Note that the AnyConnect servers are all the way at the bottom of TorGuard’s server list, and all end with “anyconnect.host.” For example, I used la.usa.anyconnect.host to create a domestic connection. The limited number of AnyConnect servers means that you’ll have fewer options for location spoofing, and will likely experience degraded speeds when using the VPN connection. That’s because your bandwidth will be shared with everyone else on this handful of servers.
Will Your VPN Work on a Chromebook?
If you decide not to use an Android VPN app on your Chromebook, you might be wondering if you can manually configure your Chromebook to work with the VPN of your choice. Fear not, gentle reader, as I have already trod the ground ahead of you and am here to share the fruits of my labor.
There are many VPNs that may work on Chrome OS; I researched the Chrome compatibility of 10 of my favorites. For each, I sought out documentation on how the company recommends Chromebook owners get online. I then tried to get online using that information.
NordVPN provides instructions, as well as warnings, on using L2TP. I was able to use these to successfully get online. Notably, NordVPN has an excellent tool on its website for finding a server that will meet your needs. NordVPN also offers a Chrome extension and an Android app.
Private Internet Access places a special emphasis on security, and using L2TP on a Chromebook requires you to generate a special username and password. Thankfully, the company provides a guide on this process, which I was able to use to get online. Private Internet Access also offers an Android app and a Chrome extension.
I wasn’t able to find the information necessary for getting TunnelBear connected via L2TP. Specifically, I couldn’t find the URLs for the VPN servers to complete the manual configuration. A company representative said that despite its limitations, they recommend that Chromebook users install TunnelBear’s Chrome extension instead. The company also offers an Android app.
Unsurprisingly, the privacy-focused CyberGhost provides extensive documentation on how to use L2TP to get your Chromebook online. However, I wasn’t able to get it to work. A CyberGhost representative told me the issue is under investigation, and recommends users look to its Android app or its Chrome browser extension.
I was able to get my Chromebook online using the server information I found on IPVanish’s user pages, but the company does not provide specific documentation for Chrome OS users. That’s disappointing. The company does, however, provide an Android app and a Chrome extension.
KeepSolid VPN Unlimited has a useful generator tool that you’ll need to get online using L2TP, which I was able to do after following the company’s documentation. As with any VPN, if you’re already at the device limit you may have to remove an existing device. With VPN Unlimited, you can only swap one device license per week, so think ahead and make sure you have available slots before you set up your Chromebook. Or you could simply buy more from KeepSolid. As expected, KeepSolid also offers an Android app and a Chrome extension for VPN Unlimited users.
In addition to its Android app, PureVPN also includes instructions on how to get your Chromebook online using L2TP. I had no problem using it to secure my connection. It does not, however, offer a browser extension for Chrome.
ProtonVPN, and its sister endeavor ProtonMail, have excellent reputations for privacy and security. Unfortunately, the company does not have any documentation indicating how Chromebook users should get online and does not provide the information necessary to connect via L2TP. That’s likely because, as I found out when I asked what protocols the company supported, my contacts told me it only supports OpenVPN and IKEv2. The company does, however, have an Android app.
Hide My Ass not only provides excellent (and accurate) documentation on connecting via L2TP, the company also has instructions on how to configure an OpenVPN connection on your Chromebook. It’s surprising, considering the company’s consumer-friendly image, that company offers such wonky instructions here. The trick is that the OpenVPN instructions involve delving into the Linux guts of your Chrome OS machine, which may be beyond you, and was certainly beyond me. Still, it’s a very respectable effort. Hide My Ass also has an Android app.
TorGuard VPN not only includes working instructions on how to use L2TP on a Chromebook, but also offers thorough instructions on how to get your Chrome OS machine online using OpenVPN (that didn’t require using the command line) and even AnyConnect. All three worked in my testing, and it’s the most comprehensive and successful experience I had during my time working on this project. Be sure to browse all of TorGuard’s articles on the subject. The company also provides an Android app.
How to Manually Configure Your Chromebook’s VPN
By changing the settings on your Chromebook, you can configure it to connect to a VPN, no client required. If you skipped all the text above, know that L2TP isn’t regarded by many VPN companies as a secure protocol. OpenVPN is my preferred option, but it frequently doesn’t work on Chrome OS because of conflicts with servers managed by VPN companies.
If you decide to go this route in securing your Chromebook, you’ll need to do a little homework first. I highly recommend contacting the customer support for your preferred VPN company or looking through the company’s documentation to help guide you. I also highly recommend reading through Google’s official documentation for using VPNs with Chrome OS.
In general, you need to find a list of the service’s VPN servers, the protocols supported by those servers, and the actual names of those servers. These should look like URLs. For example, one NordVPN server in the Ukraine is known as “ua5.nordvpn.com.” You should look for servers that support L2TP, if you’ve decided to go that direction. NordVPN, for example, lets you sort servers by the protocol they support in the advanced section of its online server selector.
Depending on the VPN service you use, you may have to copy or create new login credentials to use L2TP. You also have to track down a special passcode called a pre-shared key or shared secret. On top of that, you also need the username and password you use to access the VPN service.
As I noted above, I was only able to connect via OpenVPN through TorGuard, and only after first downloading an OpenVPN server certificate file. Again, you can find those instructions in TorGuard’s documentation. I’ll include those steps below.
- Click on your user icon in the lower-right-hand corner.
- In the pop-up that appears, click on the gear icon to open the Settings window.
- Near the top of the Settings window is the Network section. If you don’t see it, use the search box at the very top of the window. Click the caret next to the words Add connection.
- In the section that appears, click Add OpenVPN/L2TP. In older versions of Chrome OS, the resulting window will close if you click away from it. Thankfully, it stays open in newer versions for easy cutting-and-pasting.
- In the server hostname section, enter either the IP address or the full URL of the VPN server you want to use.
- In the service hostname section, you can enter anything you like. I find it useful to have the name of the VPN service as well as some information about the specific server. For example, NordVPN Ukraine.
- The Provider Type box has a dropdown containing three options. Here’s where you have to make a choice: You can either select L2TP/IPSec + pre-shared key, L2TP/IPSec+user certificate, or OpenVPN.
- If you use the L2TP/IPSec + pre-shared key option, enter the key in the next text field labeled “pre-shared key.” This is typically found in the documentation and is something very simple. One service even used “12345678” as its key. I didn’t try setting up an L2TP/IPSEC user certificate option, but do note that if you select it, a warning will appear in red at the bottom of the screen instructing you to install a user certificate.
- In order to connect to TorGuard’s OpenVPN server, I selected OpenVPN as the provider type. Using TorGuard’s documentation, I had already downloaded and imported a Server CA certificate using the tool found at
chrome://settings/certificates. In the VPN setup page, I entered all the above information, and then selected the certificate from the Server CA pulldown menu. I left the User Certificate as None installed.
- Regardless of the protocol you chose, the last step is to enter your username and password in the appropriate fields. Note that depending on the VPN service you use, these might be different than the username and password for accessing your billing information. In fan communities, OTP stands for “one true pair.” In this context, however, it means “one time password.” You may have a token or other device that generates an OTP for access, but these are rare. Odds are you’ll be leaving it blank. You can leave the Group Name field blank, too.
- Check the toggle next to “save identity and password” if you plan on using this VPN connection again the future. Then click Connect. You should connect very quickly. If not, an error message will swiftly inform you that something is wrong. If that’s the case, double-check that you have the correct login information, and that the service you have chosen supports Chrome OS.
You’ve now configured your Chromebook to connect to a TorGuard VPN server! As bonus, note that, while I haven’t benchmarked TorGuard on Chrome OS, it’s the fastest VPN on Windows.
But what if you want to change servers, or want a choice in which servers you use? You’ll need to follow the above instructions for each and every server you want to access with your Chromebook. Thankfully, switching between VPN servers is just a few clicks from the Chrome OS pop-up settings menu in the lower right corner.
Start Using a VPN on a Chromebook
Once you have a functioning VPN configuration, you can easily access it again. Just click your user icon in the lower right, and then click the VPN Disconnected option. All of the connections you’ve manually configured (again, you need one for every VPN server you plan to use) will appear under the OpenVPN/L2TP section. If you have VPN Android apps or Chrome OS apps, they’ll appear in their respective sections. To create a new configuration, just click the blue plus sign in the section you want.
To switch on the VPN, just select it from the list. That goes for Android VPN apps and Chrome OS apps, too. You can click on it a second time to configure that specific connection. Or you can open the Settings menu, navigate to the Network section, and click the caret next to the connection you want to configure.
Each connection has its own host of options. Toggles let you prefer a particular network, or always connect to the network when your Chromebook is in use. These are great options, and I recommend you use them.
You can also update the server information for a given connection, simply by overwriting the server hostname. That’s handy, in case the server you were using is deactivated by your VPN company. You can change the username and password for the connection by clicking the Configure button. Note that you can’t change the provider type (that is, the VPN protocol). To do that, you’ll have to create a new connection.
If one of your configurations doesn’t work or simply doesn’t suit you anymore, just click the Forget button.
VPNs: Confusing on Chrome
The sheer volume of people searching our site for advice on using VPNs with Chromebooks prompted me to write this article. After several days, several headaches, and several confusing emails, I can see why so many people are searching for help. It’s damned confusing.
It’s clear to me that using an Android VPN app on your Chromebook is the best option for securing your traffic—if your system supports Android apps. Arriving at that conclusion wasn’t easy. As I researched it, I found that even most VPN companies didn’t have the right information about how VPNs worked on Chromebooks. Google’s own documentation, while thorough, is short on details and advice.
Worse yet, using mobile apps on a computer might not be the first thing a consumer thinks to do. Especially when some Chromebooks still do not (or perhaps, never will) support Android apps.
A major selling point of Chromebooks is their security. With little opportunity to store or run malware, Chromebooks are a blessing to the low-cost computer market. Just restart to solve most problems and powerwash your worries away. Google needs to simplify the VPN experience on Chrome OS, since surveillance and online threats are the greatest potential pitfall for Chromebook owners. For now, Android VPN apps are your best option for protecting your Chromebook online.