How to Set Up a VPN on a Chromebook (and Which Method Actually Covers Everything)

The best way to run a VPN on a Chromebook is to install your provider's Android app from Google Play. Then add it as a connection in ChromeOS settings, and you can turn on always-on mode so it reconnects by itself. Browser extensions are lighter but only cover Chrome. The built-in VPN client works, but it's really meant for corporate VPNs where IT gives you a server address and credentials.

The three ways to run a VPN on ChromeOS

NordVPN lists the Android app, its Chrome extension and a router setup as its Chromebook options. Surfshark offers the Android app from Google Play or as an install file from its website, plus its browser extension.

Method 1: Install the Android app (recommended)

Most Chromebooks sold in recent years can run Android apps. Surfshark's Chromebook page names models from ASUS, Acer, Dell, HP, Lenovo and Samsung. If you see the Play Store in your launcher, you're set.

1. Install the app. Open the Play Store, search for NordVPN or Surfshark, and install it.
2. Sign in and connect once. Open the app, sign in, and connect to a server. Android will ask permission to set up a VPN connection. Allow it.
3. Add it in ChromeOS settings. Google's instructions: open Settings, go to Network, select Add connection, then Add next to the app's name, and follow the prompts. This lets you control the VPN from the ChromeOS quick settings panel too.
4. Turn on always-on VPN. In Settings, go to Apps, then Manage Google Play preferences, then Android Settings, then Network & internet, then VPN. Switch on Always-on VPN for your provider. The connection now comes back after a restart or a dropped network.

Method 2: Use a Chrome extension

Both providers make browser extensions, and they're useful as long as you remember the limit. Surfshark's page says its extension "only safeguards traffic within the Chrome browser," and that's true of browser VPN extensions in general. Android apps, Linux apps and system traffic go around it.

What you get in exchange is convenience and some extra browser tools. NordVPN's extension blocks ads and malicious sites and lets you exclude specific websites. Surfshark's extension includes WebRTC leak protection, ad and tracker blocking, and cookie pop-up blocking. Surfshark also says the extension encrypts browser traffic and DNS lookups.

Extensions make sense in a few cases:

• Your Chromebook doesn't support Play Store apps, or an administrator has disabled them.
• You only need a different location for one site and don't want to route everything.
• You want a quick way to switch locations inside the browser while the app handles everything else.

Method 3: The built-in ChromeOS VPN client

ChromeOS can connect to a VPN server with no app at all. According to Google's Chromebook help page, it supports:

• IKEv2 (IPsec) with a pre-shared key, a user certificate, or a username and password.
• L2TP/IPsec with a username and password, plus a pre-shared key or certificate.
• OpenVPN, which Google describes as basic support, using a username and password, a client certificate, or both.
• WireGuard, but only on some Chromebooks.

To set one up, select the time in the bottom-right corner, open Settings, choose Add connection under Network, select Add next to the VPN type, enter the server and login details, and connect. Some setups also need a certificate. You import those at chrome://settings/certificates, and ChromeOS only accepts RSA client certificates, not ECC.

For a consumer VPN, this is more work than it's worth. You'd need manual configuration details, and you'd lose the app's server list, kill switch and automatic updates. It's the right tool when your employer gives you a VPN profile.

School and work Chromebooks

If your Chromebook belongs to a school or company, an administrator manages it through Google's admin tools. Google's help page says admins can force-install VPN apps and push configuration files. They also control things like split tunneling. Surfshark points out that admins often restrict installs, so only approved VPNs will work.

Practically, that means:

• If the Play Store or the extension is blocked, there's no clean workaround. Trying to get around a school's or employer's network policy can break their acceptable-use rules.
• If you need privacy on a managed device, ask IT what's allowed. Many organizations already run their own VPN.
• For personal browsing, a personal device is the honest answer. The administrator can see and control a managed Chromebook no matter what VPN it runs.

Parents setting up a child's Chromebook can see our guide on VPNs and kids' online safety for where a VPN fits and where parental controls do the job better.

When a VPN on a Chromebook is worth it

Chromebooks are built to be online all the time, and a lot of them live in backpacks. That makes the most common reason the best one: public Wi-Fi in coffee shops, libraries, airports and campus networks. Most websites already use HTTPS, but a VPN also hides which sites you visit from whoever runs the network, and it encrypts any app traffic that isn't protected.

Other good reasons:

• Traveling and wanting your home-country versions of services you already pay for, keeping in mind that streaming services restrict region-switching and block VPNs.
• Keeping your internet provider from logging which domains you visit.
• Remote work on a network you don't control.

If you only use a Chromebook at home for Google Docs and email over HTTPS, a VPN adds less. Our when you don't need a VPN piece goes through those cases honestly.

NordVPN or Surfshark on a Chromebook

Both run the same Android apps they ship for phones, so the Chromebook experience matches what you'd get on Android. The differences are in the account and the extras:

Troubleshooting Chromebook VPN issues

The app won't install or open

Make sure Google Play is turned on under Settings, then Apps. If the option isn't there, your Chromebook may not support Android apps, or an administrator has disabled them. Use the extension instead.

Connected, but some apps ignore the VPN

The Linux environment and certain system services may not route through the Android VPN on every ChromeOS build. Check your IP from each environment you use. If something leaks, the built-in ChromeOS client or a router-level VPN is the more complete option.

Wi-Fi login pages won't load

Hotel and campus sign-in pages often break while a VPN is on, especially with always-on mode. Briefly disable the VPN, finish the Wi-Fi sign-in, then turn it back on.

Quick setup checklist

1. Check for the Play Store. If it's there, use the Android app. If not, use the extension or a router VPN.
2. Install, sign in, connect. Approve the VPN permission prompt.
3. Add the app under Settings, then Network. This puts it in your quick settings.
4. Turn on always-on VPN in the Android network settings.
5. Verify with an IP check in Chrome, and in Linux if you use it.
6. Add the extension only if you want its browser tools. One VPN connection is enough. Stacking the extension on top of the app just adds overhead.