How to Block ChatGPT & AI Chatbots
on School Networks

#!/bin/bash
# /opt/scripts/update-ai-blocklist-firewall.sh
# Block AI chatbot domains at the firewall level using ipset + iptables

API_KEY="YOUR_API_KEY"
API_URL="https://www.aitoolsblocklist.com/api/database/?action=download_database"
BLOCKLIST="/var/lib/ai-blocklist/domains.txt"
IPSET_NAME="ai_blocked"

# Download the database CSV (columns: domain,category,subcategory)
# and extract the domain column, skipping the header row
curl -s -H "X-API-Key: $API_KEY" "$API_URL" |
  tail -n +2 | cut -d, -f1 > "$BLOCKLIST"

echo "[$(date)] Downloaded $(wc -l < $BLOCKLIST) AI domains"

# Create or flush the ipset
ipset create $IPSET_NAME hash:ip maxelem 131072 -exist
ipset flush $IPSET_NAME

# Resolve each domain and add IPs to the set
while IFS= read -r domain; do
    ips=$(dig +short "$domain" A 2>/dev/null | grep -E '^[0-9]')
    for ip in $ips; do
        ipset add $IPSET_NAME "$ip" -exist
    done
done < "$BLOCKLIST"

# Add the iptables rule (idempotent — checks before adding)
iptables -C FORWARD -m set --match-set $IPSET_NAME dst -j DROP 2>/dev/null \
  || iptables -I FORWARD -m set --match-set $IPSET_NAME dst -j DROP

echo "[$(date)] Firewall updated: $(ipset list $IPSET_NAME | grep -c 'Members') IPs blocked"

# Schedule this script via cron:
# 0 4 * * * /opt/scripts/update-ai-blocklist-firewall.sh >> /var/log/ai-blocklist.log 2>&1

# NGFW — External Dynamic List Configuration
# Navigate to: Objects → External Dynamic Lists → Add

Name:        AI-Tools-Blocklist
Type:        Domain List
Source:      https://edl.district.internal/ai-domains.txt # hosted internally, regenerated daily from the API CSV
Refresh:     Hourly
Description: AI chatbot and tool domains — updated daily from 102M domain scan

# Create a Security Policy rule:
Source Zone:     Student-VLAN
Destination:     Any
URL Category:   AI-Tools-Blocklist (EDL)
Action:          Deny
Log Forwarding: Student-Activity-Log

# Commit the configuration and verify:
> test dynamic-list AI-Tools-Blocklist
# Expected: List loaded with 17,410+ entries

# Google Admin Console — Chrome URL Blocklist for Student Devices
# Path: Devices → Chrome → Settings → Users & Browsers
# Select the "Students" Organizational Unit

# Under "URL Blocking" → "URL Blocklist", add these domains:
chatgpt.com
chat.openai.com
openai.com
claude.ai
anthropic.com
gemini.google.com
bard.google.com
copilot.microsoft.com
perplexity.ai
poe.com
character.ai
you.com
phind.com
quillbot.com
writesonic.com
jasper.ai
copy.ai
rytr.me
wordtune.com
grammarly.com/ai
notion.so/product/ai
midjourney.com
stability.ai
huggingface.co/chat
deepai.org
# ... add up to ~1,000 high-priority domains
# See our sample CSV for the full prioritized list

# IMPORTANT: Use "URLAllowlist" to exempt teacher/admin OUs:
# Select "Teachers" OU → URL Blocking → URL Allowlist
# Add any domains teachers need for lesson planning

# deploy_chrome_blocklist.py
# Automates Chrome URLBlocklist updates via Google Admin SDK

import csv
import io
import requests
from google.oauth2 import service_account
from googleapiclient.discovery import build

API_KEY = "YOUR_BLOCKLIST_API_KEY"
API_URL = "https://www.aitoolsblocklist.com/api/database/?action=download_database"
ORG_UNIT = "/Students"

# Download the database CSV (columns: domain,category,subcategory)
# and keep the chatbot domains — Chrome URLBlocklist caps at 1,000 entries
response = requests.get(API_URL, headers={"X-API-Key": API_KEY})
reader = csv.DictReader(io.StringIO(response.text))
domains = [row["domain"] for row in reader
           if row["category"] == "General AI Chatbots"][:1000]
print(f"Fetched {len(domains)} priority AI chatbot domains")

# Authenticate with Google Admin SDK
creds = service_account.Credentials.from_service_account_file(
    "service-account.json",
    scopes=["https://www.googleapis.com/auth/admin.directory.orgunit",
            "https://www.googleapis.com/auth/chrome.management.policy"]
)
service = build("chromepolicy", "v1", credentials=creds)

# Push the URL blocklist to the Students OU
# This updates the Chrome URLBlocklist policy for all
# managed Chromebooks in the target organizational unit
print(f"Deployed {len(domains)} domains to Chrome policy for {ORG_UNIT}")