Skip to main content

Documentation Index

Fetch the complete documentation index at: https://mintlify.com/S-PScripts/chromebook-utilities/llms.txt

Use this file to discover all available pages before exploring further.

School networks commonly enforce content filtering at the DNS or firewall level, meaning restrictions apply to every device on the network regardless of the browser or operating system in use. By substituting a custom DNS resolver or tunneling traffic through a VPN, you can route queries around these filters entirely. The methods below range from a simple name-server swap that takes under a minute to full VPN configurations that encrypt all outbound traffic. Choose the approach that fits your version of ChromeOS and your level of access.
Many schools have explicit policies against using VPNs or bypassing network filters on school-issued devices or school networks. Review your Acceptable Use Policy before proceeding. VPN providers may also log your browsing traffic — use reputable services and understand the privacy trade-offs.

​
DNS-Based Bypasses

The fastest way to sidestep DNS-level filtering is to replace the automatic name servers assigned by your school’s network with a public resolver.IP Server options:
ServerIP Addresses
Google DNS8.8.8.8, 8.8.8.8, 8.8.8.8, 8.8.8.8
Cloudflare DNS1.1.1.1, 1.0.0.1, 0.0.0.0, 0.0.0.0
1

Open Settings

Go to Settings.
2

Open Wi-Fi details

Click on the name of the Wi-Fi network you are connected to, then click it again to open its details.
3

Open Network section

Scroll to the Network section and click it.
4

Find Name Servers

Scroll down until you find the Name servers section.
5

Set Custom Name Servers

Change the option to Custom Name Servers and paste one of the IP server sets listed above into the boxes.
CauDNS blocks requests for policy updates and certain managed extensions by importing a custom ONC network configuration file. It is configured by importing that ONC file at chrome://network.
1

Navigate to CauDNS

Go to https://caudns.vercel.app/.
If the main site is blocked, use one of these alternatives instead:
  • https://zekcurly.netlify.app/
  • The following data URL (paste it into your address bar):
data:text/html, <script src='https://cdn.jsdelivr.net/gh/dragon731012/caudns/jszip.js' defer></script> <script src='https://cdn.jsdelivr.net/gh/dragon731012/caudns/filesaver.js' defer></script> <script src='https://caudns.vercel.app/main.js' defer></script> <script> function getHtml(file){ return new Promise((resolve) => { fetch(file) .then((response) => { return response.text(); }) .then((html) => { resolve(html); }); }); } async function start(){ var html=await getHtml('https://cdn.jsdelivr.net/gh/dragon731012/caudns/data.txt'); html=html.toString(); console.log(html); document.body.innerHTML=html; } start(); </script>
2

Open chrome://network#state

In a new tab, navigate to chrome://network#state.
3

Locate your Wi-Fi network

Find the section for the Wi-Fi network you are currently connected to.
4

Expand the section

Click the + icon to expand the network details.
5

Copy the content

Press Ctrl+A to select all, then Ctrl+C to copy the expanded text.
6

Paste into CauDNS

Paste the copied text into the input field on the CauDNS website with Ctrl+V.
7

Download the ONC file

Click Download to export the generated ONC file.
8

Import the ONC file

Navigate to chrome://network#general, scroll to the bottom, and import the ONC file using the Import ONC File button.
Credits: dragon73101 (Potato) — https://github.com/dragon731012/cauDNS
If CauDNS has already been configured on your current network via an ONC file, you can set custom name servers to simulate DNS configuration on that managed network.IP addresses to use:
167.86.91.171
66.94.105.229
213.109.163.210
92.60.37.102
Navigate to your Wi-Fi settings, open the network details, scroll to Name servers, switch to Custom Name Servers, and enter the IPs above.
If you are bringing your own personal device, you can enable DNS over HTTPS (DoH) — referred to as Secure DNS in Chrome — to encrypt all DNS queries and bypass filtering at the resolver level.
1

Open Chrome security settings

Go to chrome://settings/security.
2

Find the Advanced section

Scroll down to the Advanced section.
3

Enable Secure DNS

Toggle Use secure DNS to the on position.
4

Set a DoH provider

Choose a custom provider or enter the following DoH query URL:
http://dns.adguard-dns.com/dns-query
This method only applies to BYOD (Bring Your Own Device) computers where you have full browser control. Managed Chromebooks enforce DNS settings at the OS level, which overrides per-profile browser settings.
Credits: SimpleDNS, Block-Bypass
An advanced exploit allows setting custom name servers directly via chrome://network. The full technique is documented externally; a redacted reference is kept here.Standard method (no exploit required):
1

Open Settings

Go to Settings.
2

Navigate to Network

Go to the Network section.
3

Open Wi-Fi details

Click on your Wi-Fi network.
4

Find Name Servers

Scroll down to the network section and open the drop-down.
5

Change name servers

Scroll down a bit and change your Name servers to a custom value.

​
VPN-Based Bypasses

This method uses a free L2TP/IPsec VPN to bypass all network-level content blocks on a school Wi-Fi firewall. It works against school Wi-Fi firewalls only — it does not bypass extension-based filtering.
1

Open VPN settings

Go to Settings → Network → Add connection → Add built-in VPN.
2

Select VPN type

Click OpenVPN and select L2TP/IPsec from the drop-down list.
3

Find a VPN server

Go to https://m.ipspeed.info/freevpn_l2tpipsec.php?language=en.
4

Fill in VPN details

Enter any name for the VPN. Copy the desired VPN hostname (the numbers separated by .) and paste it into the Hostname field.
5

Set credentials

For the Password, Pre-shared key, and Username fields, enter vpn.
6

Connect

Connect to the newly configured VPN from Network settings or Quick Settings.
Alternative server list with additional options: https://www.freevpn.us/pptp/us/
Credits: ash | ash._ash, Hack Hive
ProtonVPN can be configured on ChromeOS via an ONC file import. This method requires a Proton VPN account and only works on ChromeOS v129 or lower.
1

Create a ProtonVPN account

Sign up or log in at https://account.protonvpn.com/signup.
2

Get your OpenVPN credentials

Navigate to Account → OpenVPN / IKEv2 username and copy your username and password.
3

Download a server config

Download an ONC configuration file for any server you want to use (e.g., us-19). Unzip the file.
4

Edit the ONC file

Open the .onc file in the Text Editor app (built into ChromeOS) or any other text editor. At the very end of the file, after "TLSAuthContents": "-----BEGIN OpenVPN Static key V1-----, add the following — making sure to start immediately after the closing quotation mark:
,
        "Username": "(Put your username here)",
        "Password": "(Put your password here)"
5

Save the file

Save the modified ONC file.
6

Import into ChromeOS

Navigate to chrome://network#general, scroll to the bottom, and use the Import ONC File upload to import the file. You should see Networks imported: 1 (regardless of how many you imported).
Credits: Titanium Network
Surfshark VPN can bypass DNS blocks and network-level blocks on enrolled school Chromebooks running ChromeOS v128 or lower. A Surfshark account is required.Requirements:
  • A Surfshark account
  • The ability to add VPNs through ChromeOS Settings
  • chrome://networks unblocked
1

Downgrade ChromeOS

Downgrade to ChromeOS v128 or lower.
2

Log in to Surfshark

Go to https://my.surfshark.com/auth/login and sign in.
3

Download an OpenVPN config

Navigate to VPN → Manual Setup → Set Up Manually → OpenVPN → Locations → Fastest Server and download the .ovpn file.
4

Convert to ONC format

Go to https://luphoria.com/ovpn2onc and upload the .ovpn file to convert it.
5

Import the ONC file

Import the converted file into chrome://networks.
6

Add a VPN connection

Go to Wi-Fi settings → Add connection → VPN and add an IPsec/IKEv2 VPN.
7

Enter credentials

Enter your Surfshark credentials. For the certificate, select (Surfshark CA).
8

Connect

Connect to the VPN through Quick Settings. You can also enable Connect on demand.
Credits: fanqyxl, Titanium Network

​
Managed Wi-Fi Bypasses

Blobwifi bypasses restrictions applied to managed Wi-Fi networks by generating a modified ONC file. Based on CAUB. Patched on ChromeOS v129 and above.
1

Navigate to chrome://network#state

Open chrome://network#state.
2

Expand favorite networks

In the Favorite Networks section, expand each network you want to set as metered.
3

Copy the page

Press Ctrl+A to select all, then Ctrl+C to copy the entire page contents.
4

Paste into Blobwifi

Paste the copied text into the input field at https://blobby-boi.github.io/Blobwifi/.
5

Generate the ONC file

Click the Generate & Export ONC button. The ONC file will be downloaded automatically.
6

Import the ONC file

Navigate to chrome://network#general and import the ONC file using the Import ONC File upload at the bottom.
Credits: Blobby Boi, Ashtino
When a school policy restricts connections to a whitelist of approved networks, a timing-based approach can allow you to connect to any network. Tested on ChromeOS v124 through v131.Requirements: A Chromebook with whitelisted Wi-Fi networks enforced.
1

Turn off Wi-Fi

Disable Wi-Fi from Quick Settings or Settings.
2

Quickly join a network

Turn Wi-Fi back on, then immediately click Join Wi-Fi network as fast as possible.
3

Enter network details

Input the SSID, security type, and password for the non-whitelisted network.
4

Disable Wi-Fi again

Disable Wi-Fi.
5

Connect

Enable Wi-Fi again, then click Connect as fast as possible.
If you open Settings and disable Wi-Fi from there, you may be able to change network settings while the policy enforcement window is brief.
Credits: Titanium Network / Oxide Docs
If your school has blocked SSH connections within the Terminal app, you can still open saved SSH sessions using a workaround via the app launcher.
1

Open Terminal and configure SSH

Open the Terminal app and configure the SSH connection as normal. You will not be able to connect from within the app itself.
2

Close Terminal

Close the Terminal app.
3

Right-click the Terminal icon

Right-click the Terminal icon in the launcher (shelf or app drawer).
4

Click the SSH session

Click the SSH session you want to open from the context menu.
Credits: schoolexploitkid

Build docs developers (and LLMs) love

Get started for freeTalk to us