Netfree on ChromeBook

BYK

I was able to get Netfree to work on the Chromebook, and force it through chrome enterprise. but I had two small loopholes. 1 is that is the first few seconds it's not filtered, and the other one that the person can change the VPN as I only think I can force is to force that the open VPN VPN should be enforced, but a pesrson might change and ad there another VPN. for that the solution might be to force an app lock and lock the open VPN.
both should not be an issue if we use proxy. in order to get it through proxy I will need a pac file.

yzahn

@byk
Hi (welcome to the forums ),
I answered on the Hebrew forum, (the English forum has very little traffic nowadays).
To paraphrase from my answer there:

Connecting to Netfree via HTTP proxy is not an officially supported option. If you have a practical need for it, it would be worthwhile to open a ticket directly with the support explaining why you need it.
According to this article, Chromeos will shortly start supporting always-on VPN which will allow you to use Netfree via VPN without any possibility of bypass (hopefully).

shloimy95

However you actually connect to Netfree, VPN, HTTP Proxy or any other method Chrome OS can still not be fully supported by Netfree, as Google require that their domains are fully excluded from all ssl/tls inspection. Ca-certificated can only be installed in the browser, not the OS even when using Google Admin. See https://support.google.com/chrome/a/answer/6334001?hl=en&ref_topic=3504941.

BYK

@yzahn I used that VPN option but the 2 loopholes I mentioned exited there

shloimy95

@byk I believe if you use the VPN client built into the chromebook not an Android app, and set policies always on VPN and block traffic without VPN you will not have the 2 issues. To use the built in client save the following to a .onc file.

{
  "Type": "UnencryptedConfiguration",
  "Certificates": [
    {
      "GUID": "{13f7eba5-06b4-4beb-87d1-78a7323ff072}",
      "Type": "Authority",
      "X509": "MIIE6zCCA9OgAwIBAgIJALVqGDUdI6IrMA0GCSqGSIb3DQEBCwUAMIGpMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMRAwDgYDVQQLEwduZXRmcmVlMRgwFgYDVQQDEw9Gb3J0LUZ1bnN0b24gQ0ExEDAOBgNVBCkTB0Vhc3lSU0ExITAfBgkqhkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpbjAeFw0xNTEyMTgwMzI2NDNaFw0yNTEyMTUwMzI2NDNaMIGpMQswCQYDVQQGEwJVUzELMAkGA1UECBMCQ0ExFTATBgNVBAcTDFNhbkZyYW5jaXNjbzEVMBMGA1UEChMMRm9ydC1GdW5zdG9uMRAwDgYDVQQLEwduZXRmcmVlMRgwFgYDVQQDEw9Gb3J0LUZ1bnN0b24gQ0ExEDAOBgNVBCkTB0Vhc3lSU0ExITAfBgkqhkiG9w0BCQEWEm1lQG15aG9zdC5teWRvbWFpbjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJxAo2Ja6myTDYIQkOBAv0Wki73p9Nej+h8C3r3Vs7RPXXbJqEOFRLvaeyCF1Kjt/YDFy/MbOh5KCVLbk819x2yZMl8WFB302S4gQtnTO1TCbWW0vChY9OYVImnoeY9E3hKrzDJ8Ph84fvqhC6rbJ4sbM7rGyYTc41TgSDpycE0hobbkZ7DnNMn6kS/m/ekxQkEqNcIYY2Lz1pQz/Akep60xXl+DLv4H7MJGhQOu6PGh1ACxJk3/Y91Z4MF+HdbMvcAukrf3uLdfzP8Vit3/vyjzTVmQ6JbV7GQC/BPM9Xl85sF/FaeRG2Zk2tY7u58WeXrxs7c9NKdsibyUF3n144ECAwEAAaOCARIwggEOMB0GA1UdDgQWBBSTxEfHI/OR+dnC2bszBOgXI5BUkTCB3gYDVR0jBIHWMIHTgBSTxEfHI/OR+dnC2bszBOgXI5BUkaGBr6SBrDCBqTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAkNBMRUwEwYDVQQHEwxTYW5GcmFuY2lzY28xFTATBgNVBAoTDEZvcnQtRnVuc3RvbjEQMA4GA1UECxMHbmV0ZnJlZTEYMBYGA1UEAxMPRm9ydC1GdW5zdG9uIENBMRAwDgYDVQQpEwdFYXN5UlNBMSEwHwYJKoZIhvcNAQkBFhJtZUBteWhvc3QubXlkb21haW6CCQC1ahg1HSOiKzAMBgNVHRMEBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQByIpKzBf1JOH866VsgjzvCEWlGdgbDtpM1Uy54jGekUIYsAFB1WLt7LHNOkfpZCV0b9t7wcbeVDzcYhRycC5DVwAG6NJ2LQw8xO830/kRi1N6sp8TSyaxuWrGacnjfn9yXyJBh5mW+GKqSH507waB5tXOif5cD0J5RTCg7gLXWAYnOhEawqUZFR4zjRYdDo1oqn1uFhnyKQch7KWz2OYecXvKdK3Hxkojw4jnefk1nhahlmZPhHTZsf74dXHFtcMAMn9V1T/qhQHMcI3UX/H/WQJQoy5LJBRbLDzViobNH/SwR4AaHMWAHnQS2ddRTAUXfNjA2WdgN4NlbtpidNFWx"
    }
  ],
  "NetworkConfigurations": [
    {
      "GUID": "{995aea54-25d8-4570-a23d-5873b63259f5}",
      "Name": "Netfree Israel",
      "Type": "VPN",
      "VPN": {
        "Type": "OpenVPN",
        "Host": "s.il1.nfaw.netfree.link",
        "OpenVPN": {
          "Port": 143,
          "UserAuthenticationType": "Password",
          "CompLZO": "true",
          "SaveCredentials": true,
          "Proto": "tcp",
          "ServerCARefs": [
            "{13f7eba5-06b4-4beb-87d1-78a7323ff072}"
          ],
          "ClientCertType": "None"
        }
      }
    }
  ]
}