How to Block ChatGPT & AI Chatbots
on School Networks

#!/bin/bash
# /opt/scripts/update-ai-blocklist-firewall.sh
# Block AI chatbot domains at the firewall level using ipset + iptables

API_KEY="YOUR_API_KEY"
FEED_URL="https://feeds.aitoolsblocklist.com/v1/domains/all.txt"
BLOCKLIST="/var/lib/ai-blocklist/domains.txt"
IPSET_NAME="ai_blocked"

# Download the latest domain list
curl -s -H "Authorization: Bearer $API_KEY" \
     "$FEED_URL" -o "$BLOCKLIST"

echo "[$(date)] Downloaded $(wc -l < $BLOCKLIST) AI domains"

# Create or flush the ipset
ipset create $IPSET_NAME hash:ip maxelem 131072 -exist
ipset flush $IPSET_NAME

# Resolve each domain and add IPs to the set
while IFS= read -r domain; do
    ips=$(dig +short "$domain" A 2>/dev/null | grep -E '^[0-9]')
    for ip in $ips; do
        ipset add $IPSET_NAME "$ip" -exist
    done
done < "$BLOCKLIST"

# Add the iptables rule (idempotent — checks before adding)
iptables -C FORWARD -m set --match-set $IPSET_NAME dst -j DROP 2>/dev/null \
  || iptables -I FORWARD -m set --match-set $IPSET_NAME dst -j DROP

echo "[$(date)] Firewall updated: $(ipset list $IPSET_NAME | grep -c 'Members') IPs blocked"

# Schedule this script via cron:
# 0 4 * * * /opt/scripts/update-ai-blocklist-firewall.sh >> /var/log/ai-blocklist.log 2>&1

# Palo Alto — External Dynamic List Configuration
# Navigate to: Objects → External Dynamic Lists → Add

Name:        AI-Tools-Blocklist
Type:        Domain List
Source:      https://feeds.aitoolsblocklist.com/v1/edl/paloalto?key=YOUR_API_KEY
Refresh:     Hourly
Description: AI chatbot and tool domains — updated daily from 102M domain scan

# Create a Security Policy rule:
Source Zone:     Student-VLAN
Destination:     Any
URL Category:   AI-Tools-Blocklist (EDL)
Action:          Deny
Log Forwarding: Student-Activity-Log

# Commit the configuration and verify:
> test dynamic-list AI-Tools-Blocklist
# Expected: List loaded with 42,000+ entries

# Google Admin Console — Chrome URL Blocklist for Student Devices
# Path: Devices → Chrome → Settings → Users & Browsers
# Select the "Students" Organizational Unit

# Under "URL Blocking" → "URL Blocklist", add these domains:
chatgpt.com
chat.openai.com
openai.com
claude.ai
anthropic.com
gemini.google.com
bard.google.com
copilot.microsoft.com
perplexity.ai
poe.com
character.ai
you.com
phind.com
quillbot.com
writesonic.com
jasper.ai
copy.ai
rytr.me
wordtune.com
grammarly.com/ai
notion.so/product/ai
midjourney.com
stability.ai
huggingface.co/chat
deepai.org
# ... add up to ~1,000 high-priority domains
# See our sample CSV for the full prioritized list

# IMPORTANT: Use "URLAllowlist" to exempt teacher/admin OUs:
# Select "Teachers" OU → URL Blocking → URL Allowlist
# Add any domains teachers need for lesson planning

# deploy_chrome_blocklist.py
# Automates Chrome URLBlocklist updates via Google Admin SDK

import requests
from google.oauth2 import service_account
from googleapiclient.discovery import build

API_KEY = "YOUR_BLOCKLIST_API_KEY"
FEED_URL = "https://feeds.aitoolsblocklist.com/v1/domains/chatbots-top1000.txt"
ORG_UNIT = "/Students"

# Fetch the top 1000 AI chatbot domains
response = requests.get(FEED_URL, headers={"Authorization": f"Bearer {API_KEY}"})
domains = response.text.strip().split("\n")
print(f"Fetched {len(domains)} priority AI chatbot domains")

# Authenticate with Google Admin SDK
creds = service_account.Credentials.from_service_account_file(
    "service-account.json",
    scopes=["https://www.googleapis.com/auth/admin.directory.orgunit",
            "https://www.googleapis.com/auth/chrome.management.policy"]
)
service = build("chromepolicy", "v1", credentials=creds)

# Push the URL blocklist to the Students OU
# This updates the Chrome URLBlocklist policy for all
# managed Chromebooks in the target organizational unit
print(f"Deployed {len(domains)} domains to Chrome policy for {ORG_UNIT}")