Configuring VPN split tunneling on a Chromebook for a school environment means routing only specific traffic—such as district administrative tools or remote staff access—through the VPN tunnel, while letting student-facing content like Google Classroom and filtered browsing flow through the school's normal internet connection. The most reliable approach in 2026 is to deploy this through ChromeOS's built-in VPN client using either an IKEv2/IPsec configuration pushed via Google Admin Console, paired with a business VPN service like NordVPN Teams that supports per-app or per-route split tunneling.
Prerequisites / What You'll Need
- ChromeOS version 120 or later (check via Settings > About ChromeOS)
- Google Workspace for Education account with Super Admin or Network Admin privileges
- Google Admin Console access at admin.google.com
- A business VPN subscription with IKEv2/IPsec or OpenVPN support and split tunneling — NordVPN Teams ($7.99/user/month) or Surfshark for Teams ($2.99/user/month, billed annually, 5-seat minimum)
- Your VPN provider's server hostname or IP, pre-shared key or certificate, and split tunnel route list (CIDR notation)
- The Organizational Unit (OU) in Google Admin Console where Chromebooks are already enrolled
- Optional: A test Chromebook not actively used by students, for validating the config before fleet rollout
Step 1: Log Into Google Admin Console and Navigate to Network Settings
Go to admin.google.com and sign in with your Super Admin credentials. In the left navigation panel, click Devices, then Networks. You'll see a panel with options for Wi-Fi, Ethernet, VPN, and Certificates.
Click VPN. If you've never added a VPN here before, the list will be empty. Click the yellow "+" button in the bottom-right corner to create a new VPN network configuration.
Expected output: A modal form titled "Add VPN" appears with fields for Name, VPN type, Host, and authentication.
Common gotcha: If you don't see the VPN option under Networks, your Google Workspace edition may not include managed network configurations. Education Fundamentals includes it; verify your license tier in Billing before proceeding.
Step 2: Enter Your VPN Provider's IKEv2/IPsec Configuration
In the "Add VPN" form, fill in the following fields:
- Name: Use something descriptive, e.g.,
District-Staff-VPN-Split - VPN type: Select L2TP/IPsec + pre-shared key or IKEv2 (preferred — choose IKEv2 if your provider supports it; NordVPN supports IKEv2/IPsec with AES-256-GCM encryption)
- Server hostname: Enter the server address from your VPN provider's dashboard (e.g.,
us-school.nordvpn.comor your dedicated IP) - Pre-shared key: Paste the PSK from your VPN account portal
- Username / Password: Enter the VPN service credentials (for NordVPN Teams, these are per-user service credentials found under Account > Manual Setup, not your login password)
For authentication, NordVPN Teams uses username/password over IKEv2 — TOTP-based MFA applies at the dashboard login level, not at the IKEv2 handshake itself. If your school requires certificate-based auth, upload the CA certificate under Devices > Networks > Certificates first, then reference it in the VPN form.
Click Save.
Expected output: The VPN profile appears in the list with a green checkmark after validation.
Common gotcha: IKEv2 requires UDP ports 500 and 4500 to be open on your school's firewall. Confirm with your network team before testing—silent authentication failures are almost always a firewall block, not a credential issue.
Step 3: Assign the VPN Profile to an Organizational Unit
Click the VPN profile you just created. In the right panel, click Apply to. Select the Organizational Unit that contains your staff or admin Chromebooks—do not apply this to student OUs unless your intent is to route student traffic through it as well.
Click Save. The profile will push to all enrolled Chromebooks in that OU within the next policy sync cycle (typically 5–15 minutes, or triggered immediately by running sudo policy_fetch in the Chrome shell).
Expected output: Affected Chromebooks will show the VPN profile under Settings > Network > VPN without requiring user-side configuration.
Step 4: Configure Split Tunneling Routes
This is the critical step most guides skip. By default, a VPN pushes all traffic through the tunnel. For school use, you want only specific traffic (e.g., district intranet, SIS database, remote desktop to admin servers) going through the VPN, while Google Classroom, YouTube (filtered), and general browsing stay on the local school internet with existing content filters intact.
In the Google Admin Console VPN profile, locate the field "Bypass VPN for local traffic" and enable it. Then, in the "Static routes" or "Include routes" field (this label varies by ChromeOS version), enter the CIDR blocks that should go through the VPN. Example:
10.50.0.0/16 ← District intranet
192.168.100.0/24 ← Admin server subnet
203.0.113.45/32 ← SIS vendor's IP
Everything not listed here will route through the local connection, bypassing the VPN entirely.
Expected output: When the Chromebook connects to the VPN, chrome://net-internals/#proxy will show split routing — local IPs and whitelisted domains resolving without the VPN, restricted subnets resolving through it.
Common gotcha: If your VPN provider assigns dynamic IPs to their servers, split tunneling by route breaks. This is why I recommend using a provider that offers dedicated static IPs — NordVPN Teams dedicated IPs start at an additional $70/year per IP. Without a static IP, the included routes become unpredictable.
Step 5: Push Certificates if Using Certificate-Based Auth
If your district policy requires certificate-based authentication (more secure than PSK for FERPA-sensitive environments), upload your VPN provider's root CA certificate in Devices > Networks > Certificates, mark it as trusted for VPN use, and reference it in the VPN profile under "Server CA certificate."
Proton VPN for teams ($9.99/user/month, billed annually) is the only provider in this list that ships with independently audited open-source apps and published WireGuard configs, though ChromeOS's native client doesn't support WireGuard yet — making IKEv2 the practical choice for Chromebook MDM deployment regardless of provider.
Verification: Confirm Split Tunneling Is Working
On a test Chromebook in the enrolled OU:
- Connect to the VPN profile via Settings > Network > VPN > [Profile Name] > Connect
- Open chrome://net-internals/#events and filter for
NETWORK_CHANGED - Visit an internal resource (e.g., your SIS login page at a district IP) — it should load
- Visit
https://whatismyip.com— the IP shown should be your school's local WAN IP, not the VPN server IP, confirming split tunneling is active - Run a traceroute to the internal CIDR from the ChromeOS terminal (Ctrl+Alt+T, type
traceroute 10.50.0.1) — the first hop should be your VPN server, not your local gateway
You should see: Two different egress paths — VPN IP for included routes, local WAN IP for all other traffic.
Recommended Tools for School VPN Split Tunneling
NordVPN Teams
NordVPN is the most practical choice for ChromeOS MDM deployment because it natively supports IKEv2/IPsec — the only VPN protocol ChromeOS's built-in client handles without third-party software. It uses AES-256-GCM encryption, authenticates users with username/password plus optional TOTP-based MFA on the Teams dashboard, and offers dedicated static IPs (critical for stable split-tunnel routing). NordVPN is headquartered in Panama, outside both the EU and Five Eyes jurisdictions, and has undergone application audits by VerSprite (2024).
Pricing: $7.99/user/month billed annually, 5-seat minimum. Dedicated IP add-on: $70/year per IP. No per-device limit per user.
NordVPN Teams integrates with Google Workspace SSO, which means staff can authenticate using their school Google accounts rather than a separate VPN password.
Honest limitation: NordVPN's Admin Center for Teams is functional but not as polished as enterprise MDM platforms — logging is limited to connection events, not per-app traffic logs, which some IT admins want for CIPA compliance documentation.
Try NordVPN Teams — best IKEv2 compatibility for Chromebook fleet deployments.
Surfshark for Teams
Surfshark offers a lower per-user cost at $2.99/user/month (billed annually, 5-seat minimum), supports IKEv2 and OpenVPN, and includes static IP options at $3.75/month per IP. It's headquartered in the Netherlands under GDPR, audited by Cure53 (2023). MFA options include TOTP and email-based verification.
Surfshark is a reasonable choice for smaller districts watching budget — the split tunneling configuration process is identical to the steps above. The trade-off: dedicated IP options are fewer in the US than NordVPN, and the Teams management portal has less granular user role controls.
Try Surfshark for Teams — budget-friendly option for districts with tight per-user licensing budgets.
For broader VPN selection context beyond just split tunneling, our Best VPN for Small Business Employees in 2026 covers how these providers compare on policy enforcement and logging.
Troubleshooting
Issue 1: "VPN profile not appearing on Chromebook after assignment"
Fix: Force a policy refresh. On the Chromebook, open the Chrome shell (Ctrl+Alt+T), type shell, then run sudo policy_fetch. Alternatively, have the user sign out and sign back in. If still missing, confirm the device is enrolled in the correct OU — a device enrolled in a parent OU won't inherit a child OU's policy.
Issue 2: "Authentication failed — IKEv2 handshake error 24"
Fix: This error code indicates a pre-shared key mismatch or expired credentials. Re-copy the PSK from your VPN provider's dashboard (don't type it manually — PSKs with special characters get mangled). For NordVPN Teams, regenerate service credentials under Account > Services > Manual Setup and repaste into the Admin Console profile.
Issue 3: "All traffic is going through the VPN — split tunneling isn't working"
Fix: The "Include routes" field was left empty, causing the client to default to full-tunnel mode. Return to the VPN profile in Admin Console, add at least one CIDR in the static routes field, and confirm "Bypass VPN for local traffic" is toggled on. Repush the policy.
Issue 4: "VPN disconnects every 20–30 minutes on student Chromebooks"
Fix: ChromeOS aggressively suspends network connections when the lid closes or the device is idle. This is a ChromeOS behavior, not a VPN issue. In Admin Console, set Device > Settings > Power Management > Idle behavior to "Keep display on" for affected OUs, or configure the VPN profile with IKEv2 Dead Peer Detection (DPD) set to a 60-second interval to auto-reconnect.
Issue 5: "Content filter is bypassed after VPN connects"
Fix: If your school's content filter works by routing all traffic through a filtering proxy (common with GoGuardian or Securly), and the VPN routes traffic before it hits the proxy, filtering breaks. The solution is to ensure your split tunnel routes do not include the default gateway (0.0.0.0/0). Student OUs should not have the VPN applied at all — limit VPN deployment strictly to staff/admin OUs, which is why OU targeting in Step 3 matters.
FAQ
Can students on Chromebooks access the school VPN split tunnel without IT involvement?
No — and that's by design. When the VPN profile is deployed via Google Admin Console, it appears under the student's network settings but is controlled entirely by IT policy. Students cannot modify split tunnel routes, disconnect the VPN if IT enforces auto-connect, or add competing VPN extensions (those can be blocked under Devices > Apps & Extensions). The profile is read-only from the user's perspective. If a student needs to adjust anything, they must contact the IT admin who owns the Admin Console.
Does split tunneling on a school Chromebook comply with CIPA requirements?
Split tunneling itself is CIPA-neutral — CIPA requires filtering of obscene content for minors, and compliance depends on whether the filtered traffic path stays intact, not on whether a VPN exists. If you configure split tunneling so that student browsing traffic exits through the school's content filter (not the VPN), and only administrative traffic goes through the VPN tunnel, CIPA compliance is maintained. The risk is misconfiguration that accidentally routes student traffic through an unfiltered VPN path. Always verify with the "whatismyip" check in the Verification section above that student-facing traffic exits locally.
Which VPN protocols work with ChromeOS's native client without installing third-party software?
ChromeOS's built-in VPN client (as of ChromeOS 120 in 2026) supports L2TP/IPsec with pre-shared key or user certificate, and IKEv2/IPsec. It does not natively support WireGuard or OpenVPN — those require either a third-party Chrome extension (limited by Manifest V3 in 2026) or an Android VPN app installed from the Play Store. For MDM-managed Chromebook fleets in schools, IKEv2/IPsec deployed through Admin Console is the only protocol that can be pushed, enforced, and locked without user-side app installation.
What happens to VPN split tunneling when a student takes the Chromebook home?
The VPN profile follows the device, not the location. If the split tunnel routes you defined (e.g., 10.50.0.0/16) are internal school network ranges, those routes will still be sent through the VPN tunnel when the student is at home — but they won't reach anything useful since the home router can't reach the school intranet without the VPN being active and the school firewall permitting the connection. General internet traffic remains local on the home network. If the VPN is set to auto-connect, it will attempt connection on every network. Consider setting auto-connect only on school Wi-Fi SSIDs to avoid unnecessary home V