3 ms·
One of my annoyances on consumer Chrome OS is that the built-in VPN support is tricky. There's a JSON format, ONC (https://chromium.googlesource.com/chromium/sr
by twotwotwo 9y ago
One of my annoyances on consumer Chrome OS is that the built-in VPN support is tricky. There's a JSON format, ONC (https://chromium.googlesource.com/chromium/src/+/master/components/onc/docs/onc_spec.md https://chromium.googlesource.com/chromium/src/+/master/comp...), that maps to OpenVPN options. When I last used it the documentation was a bit tricky though it may have improved, I couldn't find ONC equivalents for some of my .ovpn options, and, most frustratingly, there was very little specific feedback if you try to import a configuration that isn't right. Because of all that I wonder if it was developed so Google could support specific large customers' VPNs (think school districts or companies) and its public availability was mostly an afterthought.
If you leave the GUI, you can also run openvpn yourself on a good old .ovpn file, but you lose some of the nice security properties you get with the default Chrome OS setup, you have to do cros-specific hacks to make it work (https://github.com/dnschneid/crouton/issues/2215#issuecomment-162231565 https://github.com/dnschneid/crouton/issues/2215#issuecommen... plus switching back and forth between VPN and non-VPN DNS by hand), and last I checked it made ARC (Play Store) apps' networking stop working.
I would consider paying a premium just to get my Chromebook connecting to work's VPN smoothly, though of course I'd love it if improved VPN functionality were available to everyone by default.
At some point I'm probably also going to take a second look at the latest ONC docs. It looks like they've improved since I first looked at VPN setup a while back.
- corybrown 9y agoWhat about non-OpenVPN? Any good option that works well with Chromebook?
- massar 9y agoAs there is a Linux kernel underneath, basically anything could in theory work; but non-standard options require 'developer mode' operation which kinda destroys the security model of ChromeOS. Android apps (on some models of the laptops) might work though. Having support for Wireguard would be pretty neat, but afaik not possible yet. OpenVPN works quite fine for my use cases up to now.
- twotwotwo 9y agoI need to connect to my work's OpenVPN network, so I can't really use other options and don't know much about them.
- tssva 9y agoPulse Secure, Cisco, F5, Palo Alto and SonicWALL provide VPN clients for Chrome OS. The Cisco AnyConnect client will also work with the open source openconnect vpn server although doing so is a violation of the client's license. L2TP/IPsec VPNs are supported out of the box.
- massar 9y agoPlease do check: https://unfix.org/projects/chromeos-openvpn-onc/ https://unfix.org/projects/chromeos-openvpn-onc/ which is a WebUI thingy I wrote to solve exactly that problem. [disclaimer: "advertising" tool I wrote]
- twotwotwo 9y agoNeat tool, and glad it's here for others to see. It doesn't look like it matches the specific kind of ovpn setup I'm using (for example, I don't have a client key/cert). When I last looked at the situation, I couldn't find an ONC equivalent for some of the options in the .ovpn file. It might be the docs or even functionality have gotten better. (I remember looking at some PDF, for example, and now there's https://chromium.googlesource.com/chromium/src/+/master/components/onc/docs/onc_spec.md. https://chromium.googlesource.com/chromium/src/+/master/comp...) It's also possible I just missed something last time. Either way I should take another look.