New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 665941 link

Starred by 68 users

Issue metadata

Status: Unconfirmed
Owner:
Last visit > 30 days ago
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 1
Type: Feature



Sign in to add a comment

[FR] Include VPN on the list of Restricted Network Interfaces

Reported by stepheng...@amplifiedit.com, Nov 16 2016

Issue description

UserAgent: Mozilla/5.0 (X11; CrOS x86_64 8872.44.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.42 Safari/537.36
Platform: 8872.44.0 (Official Build) beta-channel samus

Steps to reproduce the problem:
1. Enroll Chromebook and restrict network to only managed networks
2. Allow users to take devices home

What is the expected behavior?

What went wrong?
Users will not be allowed to access online content when devices are at home.  The recommended solution would be to not restrict networks, but this opens up the ability to add a VPN, which many students have found as a means of getting around school filters.

Did this work before? N/A 

Chrome version: 55.0.2883.42  Channel: beta
OS Version: 8872.44.0
Flash Version: Shockwave Flash 23.0 r0

Educational environments would like to have the capability to restrict use of the "Add Connection > OpenVPN - L2TP" within their environments without completely restricting access to users adding non-managed networks.  Adding the "OpenVPN - L2TP" to the Restrict Network Interfaces seems like the most logical place for this type of a restriction.
 
We are having the same issue.  Following and bumping up!
We have 7K+ Chromebooks deployed here in RI, with more on the way - the ability to control students' access to VPN connections would be huge, as it's becoming a problem for us.
We work with many schools in the UK where this is a big issue. We try and push Chromebooks on a'security' tickets but this remains a backdoor that students are only to happy to open.
This would be a huge improvement, especially in school environments!

Comment 5 by roy...@google.com, Dec 22 2016

Labels: -Pri-2 Pri-1
Owner: maxkirsch@chromium.org

Comment 6 by roy...@google.com, Dec 22 2016

Labels: Hotlist-Enterprise
A big yes for this. 
Adding our voice to this one.  Add as an enhancement please.
Frederick County, VA
Components: OS>Systems>Network
+1. For business cases, there is risk that a user could connect unchecked to an external VPN provider, exfiltrate data, get around policy.
+1 more for this feature.  Users trying to circumvent filtering measures by using this option. 
Our students are always trying to work around filter measures to use a VPN.  Please block this feature... it would be much appreciated!

Comment 13 by ghol...@sdcc.net, Feb 26 2018

It's a safeguarding issue as well. +1 for me
Yes - this is very much needed.
We would like to see this feature added in King George, VA.
Cc: maxkirsch@chromium.org
 Issue 823104  has been merged into this issue.
related: crbug.com/731104
18 plus months and no progress. Can we get an update?
@Max - any update on progress on this issue?
Cc: naveenv@chromium.org
Owner: naveenv@chromium.org
Don't think it's been looked at yet. Sending to naveenv@ for EDU prioritization.
This would be a huge help for us.  Our students are figuring out that they can connect via VPN and bypass our filters.  the solutions that we could find would not allow them to connect at home, and so they're not viable.  Something as simple as a url that we could block, such as chrome://settings/VPN, would work.  Right now, blocking chrome://settings would work, but unfortunately would block too much.  
This is a must in google for education!

Comment 23 Deleted

This needs to be looked at for EDU!
Google Admin > Device management > Chrome > User Settings:

scroll down to Block Extensions by Permission: Block VPN Provider


This is what we are using to stop any apps from being used for VPN connection 
mglo...@sgs-austin.org, that is only blocking apps or extensions that are used for VPN connections.  There are other ways of doing it, which students are figuring out.
Thanks comment #25, but students are still able to go to Settings > VPN > and manually add OpenVPN/L2TP servers.  Of course they need to have an account on one of those servers, but it's easy enough to go spin up a free one.  For school divisions who use Securly for Chromebooks, the extension does still block URL's even when connected to an OpenVPN/L2TP server.  I assume other content filters that use a Chromebook extension would have similar behavior.
I see what you mean now. I would prefer to have a way to disabled settings access for users. 

Sign in to add a comment