How to Set Up a VPN on a Chromebook: The Three Routes, Explained

A Chromebook can run a VPN three different ways: install an Android VPN app from Google Play, add a Chrome extension, or type the connection into ChromeOS's built-in VPN client under Settings. They protect different things and suit different jobs, so the right choice depends on whether you care most about streaming, privacy, or simply getting online at all.

The three routes at a glance

Before touching any settings, it helps to understand what each method actually does to your traffic. On ChromeOS the three routes differ in how much of the device they cover and how much control your provider gives you. Picking wrongly is the single most common reason a Chromebook VPN feels broken when it is really just misapplied.

• Android VPN app (Google Play): the modern default. It installs like a phone app and, once connected, routes traffic for the whole Chromebook — browser, Android apps, and most system traffic — through the tunnel. Uses fast modern protocols the vendor maintains.
• Chrome extension: a lightweight proxy that only affects traffic inside the Chrome browser. Android apps, other browsers, and system-level connections are untouched. Quick to toggle, but partial by design.
• Native ChromeOS client (Settings): the built-in dialog under Network, where you manually enter server details for L2TP/IPsec, IKEv2/IPsec, or (on supported models) WireGuard. No app to install, but you supply every field yourself.

If you want one sentence to carry away: the Android app is what most people should use, the extension is a convenience layer, and the native client is for hand-configured or work-issued connections. Our editors' picks live in the main best VPN guide if you have not chosen a provider yet.

Check this before you start: ChromeOS version and who manages the device

Two things decide which routes are even available to you: your ChromeOS version and whether the Chromebook is managed by a school or employer. Skipping this check is why so many setup attempts stall halfway. Take thirty seconds to confirm both before you download anything or open Settings.

Find your ChromeOS version

1. 1Select the time in the bottom-right corner, then the gear to open Settings.
2. 2Choose About ChromeOS at the bottom of the left menu.
3. 3Note the version number, and select Check for updates. Google Play support and the newer native protocols (IKEv2, WireGuard on some models) all rely on a reasonably current build, so update before troubleshooting anything.

Is your Chromebook managed?

School and work Chromebooks are enrolled in Google Admin, and the administrator can block the Play Store, disallow extensions, and hide or lock the native VPN dialog. If you see a Managed by your organization notice in Settings, or a briefcase icon in the corner, assume restrictions apply.

• If Google Play is blocked, the Android-app route is off the table — the store simply will not appear.
• If the Chrome Web Store is filtered, extensions may install but silently fail to route traffic.
• Some organizations pre-load an approved VPN profile into the native client for you; others disable the whole Network panel.
• On a fully locked-down managed device, no consumer VPN is a realistic option. Ask your IT administrator what is permitted rather than fighting the policy — bypassing it can breach acceptable-use rules.

Route 1: The Android VPN app (best all-round)

For the vast majority of personal Chromebooks made in the last several years, the Android app is the route to use. It covers the whole device with fast, current protocols, and the provider handles updates and server maintenance for you. If your Chromebook has the Google Play Store, start here and you can ignore the other two routes entirely.

1. 1Open the Google Play Store from your app launcher. If it is missing, your device either lacks Play support or is managed — see the section above.
2. 2Search for your VPN provider by name and install its official Android app. Check the developer name matches the brand to avoid copycats.
3. 3Open the app and sign in with your account. Grant the connection-request permission ChromeOS shows the first time you connect — this is what lets the app create the system-wide tunnel.
4. 4Pick a server location and connect. A key icon appears in the status area when the tunnel is live.

Because an Android VPN app routes essentially all Chromebook traffic, it is the right choice when you want blanket coverage rather than browser-only protection. If you plan to travel or watch region-locked libraries, this is also the route that behaves most like the desktop apps described in our best VPN for streaming guide.

Route 2: The Chrome extension (fast, but browser-only)

A Chrome extension is the quickest thing to toggle and the easiest to forget its limits. It secures only what happens inside the Chrome browser tab — nothing else on the machine. That is fine for casual browsing or flipping location for a single site, but it is not whole-device protection, and you should not treat it as such.

1. 1Open the Chrome Web Store and search for your provider's official extension.
2. 2Select Add to Chrome, then confirm the permissions prompt.
3. 3Click the extension icon (pin it from the puzzle-piece menu if it is hidden), sign in, and choose a location.
4. 4Toggle it on. The icon usually changes colour to show the proxy is active.

The catch to remember: because the extension only touches browser traffic, anything outside Chrome — an Android streaming app, a system update, another browser — still uses your real connection. It also does nothing to stop a WebRTC leak unless the extension explicitly blocks it, which is one more reason to verify your setup rather than assume it is airtight.

Route 3: The built-in ChromeOS client (manual, no app)

ChromeOS ships with a native VPN client under Settings, and it is the route you use when you have server details to type in by hand — a work profile, a self-hosted server, or a provider that publishes manual credentials. There is nothing to install, but you are responsible for every field, and one wrong entry means no connection.

Modern ChromeOS supports three built-in protocol types in this dialog: L2TP/IPsec (with a pre-shared key or user certificate), IPsec (IKEv2), and, on some newer models, WireGuard. There is also an OpenVPN provider type, but it is not a straightforward hand-entered setup — it generally requires importing a certificate or an Open Network Configuration (ONC) file, so for OpenVPN most people are better off using the provider's app instead.

1. 1Select the time, then the gear to open Settings.
2. 2In the Network section choose Add connection, then Add next to Add built-in VPN.
3. 3Choose the Provider type: L2TP/IPsec or IPsec (IKEv2). Enter the server hostname or IP.
4. 4Pick the authentication type — pre-shared key, user certificate, or username and password — and fill in the credentials your provider or administrator gave you.
5. 5Save, then open the network menu and select the new VPN to connect.

A word of realism: older third-party guides say Chromebooks cannot do IKEv2 without L2TP. That was true on much older builds, but current ChromeOS does expose an IPsec (IKEv2) provider type directly, with a pre-shared key, user certificate, or username-and-password (EAP) as the authentication choice. If it is missing on your device, update ChromeOS first, then fall back to L2TP/IPsec.

Streaming vs privacy: which route wins

The best route depends on the job. Streaming and privacy pull in different directions — one wants speed and app-level coverage, the other wants a leak-free, always-on tunnel — and the three ChromeOS routes are not equally good at both. Matching the route to the goal saves a lot of frustration.

For streaming

Streaming services do most of their work inside dedicated Android apps and, increasingly, detect and block browser-only proxies. That makes the Android VPN app the clear winner: it covers the streaming app itself, not just a browser tab. A browser extension often gets flagged, and the native client, while whole-device, uses protocols that can be slower for high-bitrate video.

• Choose the Android app and connect to a server in the country whose library you want.
• Prefer nearby servers for less buffering; distance costs speed. You can sanity-check throughput with our free VPN speed test.
• For catalogue-specific walkthroughs, our commercial guides cover Netflix and BBC iPlayer in depth.

For privacy

If your priority is keeping your traffic and location private, whole-device coverage and a verified leak-free tunnel matter more than raw speed. The Android app again leads because it protects everything on the Chromebook, not only Chrome. Whichever route you use, confirm it with the checks below rather than trusting the on-screen key icon alone — see our best VPN for privacy guide for how to think about trust and logging.

How to confirm your VPN is actually working

Connecting is not the same as being protected. A tunnel can be up while your real IP or DNS still leaks — especially with the browser-only extension route. Two quick checks take under a minute and tell you whether the setup is genuinely doing its job before you rely on it for anything sensitive.

1. 1Check your public IP. Before connecting, search what is my IP and note the address and country. Connect the VPN, reload, and confirm both changed to the server location you chose. If they did not, traffic is not going through the tunnel.
2. 2Test for leaks. Run a DNS-leak and WebRTC-leak test. If DNS requests still show your real internet provider, you have a DNS leak; if a site can still read your true local IP inside the browser, you have a WebRTC leak. Either means the protection is incomplete.

If the extension route passes the IP test but fails a leak test, that is expected — extensions only cover the browser and often skip WebRTC. Switch to the Android app for a whole-device tunnel, and re-run both checks. Whether a given location unblocks a specific service is a separate question you can look up on our can I watch tool.

Common problems and quick fixes

Most Chromebook VPN failures come down to a handful of causes, and nearly all are quick to resolve once you know where to look. Work through these in order before assuming the VPN itself is broken — the fault is usually the device state or a mismatched route rather than the provider.

• No Play Store, no VPN app: your device lacks Android support or is managed. Use the native client or ask your administrator.
• Extension connects but streaming still blocks you: the service detects the proxy or your Android app is bypassing it. Switch to the Android app for that service.
• Native client refuses to connect: re-check the server hostname, pre-shared key, and username for typos; these fields are case-sensitive and unforgiving.
• IKEv2 option missing: update ChromeOS, then retry; on stubborn devices use L2TP/IPsec instead.
• Everything looks connected but a leak test fails: move from the extension to the whole-device Android app, and disable any conflicting second VPN.

Once your Chromebook is sorted, the same provider account usually covers your phone, TV box, and home network. Our guides for Android TV and routers pick up from there, and free-tier options are compared in our free VPN roundup if you want to test the waters first.