Short answer: A Chromebook can use a VPN in two ways: a built-in connection you set up under Settings > Network, or an Android VPN app from the Play Store on models that support it. Google lists IKEv2, L2TP/IPsec and OpenVPN as built-in options, with WireGuard on some models. For most people, the provider’s Android app is the simpler route.
Checked against the sources listed at the end of this page on October 5, 2026. We did not run our own tests; where a figure comes from a vendor, the text says so.
What ChromeOS supports natively
According to Google’s Chromebook help page, ChromeOS can connect to these VPN types without extra software:
- IKEv2, using a pre-shared key, a user certificate or EAP authentication
- L2TP/IPsec
- OpenVPN, with a username and password or a certificate
- WireGuard, available on some Chromebook models
To add one, select the clock at the bottom right, open Settings, and in the Network section choose Add connection. You will need the server address and credentials from your VPN provider. Many consumer VPN services publish ready-made configurations for the first three protocols; check your provider’s setup pages before you start.
Using a provider’s Android app
If your Chromebook has Play Store access, you can install your VPN provider’s Android app, sign in, and let it create the connection. Google says you can then manage it from the same Network settings, and you can turn on Always-on VPN so the connection stays up. This route usually gives you the provider’s own server list and any extra features without manual setup.
For people who need advanced OpenVPN features or want to import a configuration file, Google recommends installing the OpenVPN for Android app instead of relying on the built-in client.
Which route should you pick?
| Situation | Better fit |
|---|---|
| You use a commercial VPN with its own Android app | The provider app, with Always-on VPN turned on |
| Your workplace or school gives you connection details | The built-in connection under Settings > Network |
| You have an OpenVPN configuration file | The OpenVPN for Android app, as Google recommends |
| Your Chromebook has no Play Store access | The built-in connection, if your provider supports one of the listed protocols |
School and work Chromebooks
Google’s page includes a plain warning: if you use a Chromebook at work or school and have problems with your VPN, contact your administrator. Managed devices often restrict what you can add. Do not try to work around those limits on a device you do not control.
What a VPN does not do on a Chromebook
A VPN encrypts the connection between the device and the VPN server and changes the address websites see. It does not scan files or stop malware. For that question, see whether you need antivirus on a Chromebook. It also does not guarantee that a service will accept the connection; some sites block VPN addresses.
Checks after you connect
- Open an IP lookup page and confirm the address and country match the VPN server you chose.
- Run a DNS leak test. Our comparison of free DNS leak test tools explains what to look for.
- Try turning the connection off and on to see how the Chromebook behaves when the VPN drops, and check whether Always-on VPN reconnects it.
To understand which protocol to choose when your provider offers several, VPN protocols explained covers the trade-offs, and our VPN comparison lists providers with the sources behind each claim.
Always-on VPN: what it does
Always-on VPN is the setting that makes an Android VPN app the only way your traffic leaves the Chromebook. Google’s documentation says that if the VPN connection fails, all user traffic is blocked until the connection is re-established. That is protective, but it also means you lose internet access when the VPN drops.
Google recommends checking that the VPN app is working and connected after you sign in to the device, after it wakes from sleep, and after it has been locked for a long time. If you have no internet, the VPN is one of the first things to check.
Notes for administrators
Managed Chromebooks are configured through the Admin console. Google’s Chrome Enterprise help page on Android VPN apps covers setting up always-on VPN for an organization, and its documentation on SAML sign-in describes a setting for URL exceptions that applies from ChromeOS 122. It also notes that certificates installed on ChromeOS are not automatically shared with Android apps. If you are an end user on a managed device, these settings belong to your administrator.
Frequently asked questions
Does a Chromebook have a built-in VPN?
It has a built-in VPN client, not a VPN service. You still need a server and an account from a provider or an organization.
Is WireGuard supported?
Google says WireGuard is available on some Chromebook models, so check your device and your provider’s instructions.
Can I use an Android VPN app on any Chromebook?
Only on Chromebooks with Play Store access, according to Google’s page.