The Chromebook App Filter provides real-time filtering and seamlessly integrates with Linewize Filter, ensuring your policies are consistently applied. This article outlines the steps to install the Chromebook App Filter using Google Workspace.
Important
The Chromebook App Filter can’t filter Progressive Web Apps (PWAs) because they run on Chrome OS rather than Android OS.
Before you begin
- Ensure you have managed devices.
- Your devices must meet the Qoria Filter minimum system requirements.
1. Add the Qoria Filter app
- Sign in to the Google Workspace Admin Console.
- On the sidebar, go to Chrome > Apps and Extensions.
- Select the + button in the bottom right of the age and select Add from Google Play.
- Search for and select Qoria Filter.
- Select the app to configure its settings.
- Under Installation Policy, select Force Install.
- Move down to the Managed configuration section.
2. Create a certificate
You must create a certificate to allow secure communication between devices and the Linewize Filter Appliance.
- Sign in to Linewize Filter.
- Go to Configuration > Self Service Certificates.
- Complete the required fields:
- Country (C): Select a country from the list.
- State/Province (ST): Enter your state.
- Locality (L): Enter your city.
- Organisation (O): Enter your school’s name.
- Common Name (CN): Enter your school’s domain name.
- Key size (bits): Select a key size, or use the default. Larger keys provide stronger security.
- Validity for (days): Enter the number of days the certificate remains valid. We recommend rotating certificates every two years.
- Select Generate.
- Copy the Signing Certificate and Signing Certificate Key for use in the next step.
- The certificate downloads automatically.
3. Add Managed configuration
Configure Managed settings
- In Google Workspace Admin Console, go to Chrome > Apps and Extensions.
- Select the Qoria Filter app.
- Under Managed configuration, enter the following JSON:
{
"LW_Mode": "Android_Companion",
"LW_DeviceId": "PHYS-SMIC-US-XXXX-XXXX",
"LW_AdditionalDeviceIds": null,
"LW_DeviceName": "",
"LW_MacAddress": null,
"LW_Region": "syd-1",
"LW_UserName": "",
"LW_BypassDomains": null,
"LW_AuthSecret": "",
"UniqueDeviceID": "",
"VpnAllowedAndroidApps": "",
"SigningCertificate": "",
"SigningCertificateKey": ""
}Required settings
All required keys must contain valid values. If any required value is missing or invalid, provisioning fails.
-
LW_Mode
Set to Android_Companion. Sets the device to Linewize Filter mode. Don’t change this value. -
LW_DeviceId
The primary device ID for the Linewize Filter Appliance. -
LW_DeviceName
The device name for the Linewize Filter Appliance. -
LW_Region
The deployment region for your school. Supported values:- syd-1 — United States and New Zealand
- syd-2 — Australia
- uk-1 — Europe
-
LW_UserName
The signed-in Chromebook user. You can use variables:- ${USER_EMAIL} — full email address
- ${USER_EMAIL_NAME} — email prefix (no domain) This value must match the username format used in Linewize Filter.
-
LW_AuthSecret
The secret key from your Linewize Filter Appliance. A Linewize Deployment Engineer provides this value. -
SigningCertificate
The certificate value generated in the previous step. -
SigningCertificateKey
The certificate key generated in the previous step.
Optional settings
-
LW_AdditionalDeviceIds
Comma-separated list of additional Linewize Filter Appliance IDs for multi-appliance deployments. -
LW_BypassDomains
Comma-separated list of domains excluded from filtering and reporting. -
LW_MacAddress
The Chromebook MAC address, if required during enrollment. -
UniqueDeviceID
An identifier for the physical device, such as ${DEVICE_SERIAL_NUMBER}. -
VpnAllowedAndroidApps
Comma-separated list of Application IDs forced through the Qoria Filter VPN. Warning: We recommend leaving this field empty. Qoria Filter automatically detects which apps require VPN routing. Only enter values if you need greater control.
- Select Save.
4. Sync certificates
- In Google Workspace Admin Console.
- On the sidebar, go to Devices > Chrome > Settings.
- Find Android apps > Certificate synchronization.
- Turn on Use Chrome OS CA certificates in Android apps.
- Select Save.
5. Add the trusted certificate
The trusted certificate allows the Qoria Filter app to inspect encrypted traffic.
- In Google Workspace Admin Console.
- On the sidebar, go to Devices > Networks.
- Select the organizational unit (OU) that applies to your users. By default, the top-level OU is selected.
- Move to Certificates, then select Upload certificate.
- Enter a name for the certificate, then select Upload.
- Select the certificate file downloaded during Create a certificate.
- Under Certificate authority, select Enabled for Chromebook.
- Select Add.
6. Turn on VPN bypass for Chrome
VPN bypass ensures that Chrome traffic continues to flow through the Linewize Connect for Chrome extension rather than the Qoria Filter VPN.
- In Google Workspace Admin Console.
- On the sidebar, go to Devices > Chrome > Settings.
- Select the correct organizational unit and confirm you are on the User and browser settings tab.
- Move to Network and find Always-on VPN URL exceptions.
- In the configuration field, enter:
* - Select Save.
7. Turn on Always-on VPN
- In Google Workspace Admin Console.
- On the sidebar, go to Devices > Chrome > Settings.
- Select the correct organizational unit and confirm you are on the User and browser settings tab.
- Move to Network and find Always-on VPN.
- Select Edit, choose Qoria Filter App, and select OK.
- Turn on Do not allow users to disconnect from a VPN manually.
- Select Save.