Related guides
On a Company Laptop: No Admin Rights, Corporate VPN Already On
Updated
A company laptop comes with three limits: unapproved software cannot be installed, there are no admin rights, and a corporate VPN is often already running. A device-wide VPN either will not install or fights the corporate one. The right tool is the web proxy — a browser extension that routes only that browser’s requests, leaving the intranet, the mail client and the corporate VPN exactly where they are, with no admin rights needed. This guide covers setup, what it can and cannot do, and how to stay within the company’s IT policy.
Why the web proxy
- No client: it is only a browser extension, and most companies allow extensions but not software installs.
- No admin rights: the extension runs in user space and never touches system network settings.
- Coexists with the corporate VPN: the corporate VPN owns the system routes; the web proxy lives inside the browser, and the two do not interfere. Intranet pages keep going through the corporate VPN.
- By design there is no connection to drop: the proxy works per request with no long-lived connection, so office-network hiccups go unnoticed.
Two-step setup
- Install the ZeroOmega extension (the maintained successor of SwitchyOmega); this site’s web-proxy page links each browser’s install page.
- Log in to the site, click “copy the extension restore URL” on the web-proxy page, then in the extension’s Import/Export choose “Restore from online” and paste. Regions and addresses import at once; afterwards pick a region from the extension icon and enter your site credentials in the browser’s login prompt.
- Use a separate browser profile (or a second browser) for the proxy, keeping the work browser local so the two never mix.
What it can do, and what to use for the rest
- Can: research, Google, GitHub, Stack Overflow, overseas documentation sites, ChatGPT on the web, webmail.
- Outside the browser: video apps, desktop software and command-line tools connect by their own settings (the command line can take the proxy address in the http_proxy variable — see the Linux guide). Apps like Dropbox that only accept unencrypted HTTP / SOCKS5 should use their web version instead (all our proxies are encrypted) — see the Dropbox / app proxy guide.
- Chinese video sites from abroad: use a device-wide VPN — they also check IPv6 and DNS, and only a device-wide method takes over both.
Staying within IT policy
Everything on a company laptop may be audited, extensions included. Read the acceptable-use policy first: most companies prohibit unapproved software and bypassing security controls, while a browser extension reaching external sites is usually a grey area — ask IT if unsure.
Do not install a device-wide VPN (Cisco, the private network, Hiddify) on a company laptop to get around policy: they change system routes, trigger endpoint-management alerts and carry intranet traffic outside. The web proxy touches one browser and carries the least risk.
Keep work and personal accounts apart: no company accounts in the proxied browser, no personal accounts in the work browser.
FAQ
What if the company blocks extensions?
Then there is no safe way on that machine; use your own phone or personal laptop. Do not bypass controls with portable software of unknown origin.
Can the extension see my intranet traffic?
No. Under split rules, intranet domains go direct and never touch the proxy; in global mode they merely pass through the proxy server and back, and the proxy sees domains, not content. For safety, give the proxy its own browser profile.
Does the proxy still work with the corporate VPN on?
Yes, they do not conflict. A few corporate VPNs force all traffic through the company exit and disable proxy settings; then the extension reports a connection failure and the only option is turning the corporate VPN off.
Same on a company Mac?
Yes — the Chrome, Edge and Firefox extensions all have Mac versions. Safari has no such extension; use another browser.