chat.openai.com禁止访问解决办法（Access denied Error code 1020）

Nov 22, 2023

—

from

chatGPT（Chat Generative Pre-trained Transformer 的缩写）是 OpenAI 的聊天机器人。它使用基于 AI/ML 的学习技术为您的查询提供答案。不幸的是，当通过 WireGuard 或 OpenVPN 等 VPN（虚拟专用网络）连接时，ChatGPT 会拒绝访问，并且您将被阻止并显示以下消息：

Access denied Error code 1020 You do not have access to chat.openai.com.
The site owner may have set restrictions that prevent you from accessing the site.

解决办法的逻辑很简单：找到chat.openai.com的IP地址并设置路由策略跳过VPN的网关。
默认情况下，WireGuard 或 OpenVPN 将通过VPN网关路由所有流量，我们自己改一下默认路由即可。

注意哈！！本人的环境如下，本地桌面是Debian or Ubuntu Linux操作系统，搭建的WireGuard或者OpenVPN 服务位于vps 服务器上，在这个服务器上的默认网关：IPv4: 192.168.2.254。
换句话说，以下的命令是在我的桌面操作系统（Debian or Ubuntu Linux）上执行的，macOS 或者 Windows 10/11 不支持！

查看默认路由：
ip route show

default via 192.168.2.254 dev enp0s31f6 proto dhcp metric 100 
10.83.200.0/24 dev lxdbr0 proto kernel scope link src 10.83.200.1 
169.254.0.0/16 dev ln-sg scope link metric 1000 
172.16.0.0/24 dev ln-sg proto kernel scope link src 172.16.0.6 metric 50 
192.168.2.0/24 dev enp0s31f6 proto kernel scope link src 192.168.2.25 metric 100

这里涉及到路由算法路径的问题，route metric，上面红色字体的路由度量值是 metric 100，我们把chat.openai.com 的ip的度量值设为10，放在最前面，优先路由即可。：

Link/Dest/Route	Metric
chat.openai.com (or any other IP/domain of your choice)	10
WireGuard/OpenVPN	50
Default	100

查下chat.openai.com 的ip地址：

d='chat.openai.com'
dig +short A "$d" | grep -v '\.$'
ips="$(dig +short A "$d" | grep -v '\.$')"
echo "$ips"

这个ip可能有多个，接下来设置一下shell变量，准备一个shell脚本，将metric设置为10，自动加路由:

my_gw="192.168.2.254" #Default GW
metric="10" #Routing metric value
for i in $ips
do
  sudo ip route add "$i" via "$my_gw" metric "$metric"
done

使用下面命令查看路由：

ip route show
ip route show | grep -w 'metric 10'

结果如下：

104.18.2.161 via 192.168.2.254 dev enp0s31f6 metric 10 
104.18.3.161 via 192.168.2.254 dev enp0s31f6 metric 10

这样就基本完成了，总结上面的技巧，生成的shell脚本 routing.policy 如下：

#!/bin/bash
# routing.policy - Main script to add, remove and list routing policy
# Author : Vivek Gite {www.cyberciti.biz} under GPLv 2.x+
# ----------------------------------------------------------------------
set -e
 
# Set metric and gateway as per your needs 
metric="10"
my_gw="192.168.2.254"
domain="chat.openai.com facebook.com fbcdn.net static.xx.fbcdn.net www.facebook.com"
ips=""
me="${0##*/}" # who am I?
 
get_domain_ip_lists(){
    for d in $domain
    do
        ips="${ips} $(dig +short A "$d" | grep -v '\.$')"
    done
    ips="${ips/$'\n'/ }" # remove '\n'
    ips="$(tr ' ' '\n'<<<"${ips}" | sort -u | xargs)" # remove duplicate ips
}
 
is_route_exists(){
    local i="$1"
    out="$(ip route show "$i")"
    if [[ "$out" != "" ]] 
    then
        return 0  # True
    else
        return 1 # False
    fi
 
}
add_opneapi_route(){
    check_for_root_user
    echo "Adding ${ips/$'\n'/,} to routing table ..." 1>&2
    for i in $ips
    do
        if ! is_route_exists "$i"
        then
            sudo ip route add "$i" via "$my_gw" metric "$metric"
        else
            echo "$me route for $i already exists, skiping ..."
        fi
    done
}
 
remove_opneapi_route(){
    check_for_root_user
    echo "Removing ${ips/$'\n'/,} from routing table ..." 1>&2
    for i in $ips
    do
        if is_route_exists "$i"
        then
            sudo ip route del "$i" via "$my_gw"
        else
            echo "$me route for $i not found, skiping ..."
        fi
    done
}
show_openapi_route_status(){
    echo "Routing info for the '$domain' (${ips/$'\n'/,}) ..." # remove newline from the ${ips}
    for i  in $ips
    do
        ip route show "$i"
    done
  
}
 
check_for_root_user(){
if [[ $EUID -ne 0 ]]; then
   echo "$me script must be run as root" 1>&2
   exit 1
fi
}
 
## main ##
get_domain_ip_lists # set '$ips' 
case "$me" in
    routing.policy.add) add_opneapi_route;;
    routing.policy.delete) remove_opneapi_route;;
    routing.policy.remove) remove_opneapi_route;;
    routing.policy.show) show_openapi_route_status;;
    routing.policy.status) show_openapi_route_status;;
    *) echo "Usage: routing.policy.add|routing.policy.delete|routing.policy.status";;
esac

授权：
chmod +x -v routing.policy
设置软链：
ln -sv routing.policy routing.policy.add
$ ln -sv routing.policy routing.policy.remove
$ ln -sv routing.policy routing.policy.delete
$ ln -sv routing.policy routing.policy.show
$ ln -sv routing.policy routing.policy.status

ls -l routing.policy*

-rwxrwxr-x 1 vivek vivek 1913 Feb  3 00:07 routing.policy
lrwxrwxrwx 1 vivek vivek   14 Feb  3 00:08 routing.policy.add -> routing.policy
lrwxrwxrwx 1 vivek vivek   14 Feb  3 00:08 routing.policy.delete -> routing.policy
lrwxrwxrwx 1 vivek vivek   14 Feb  3 00:08 routing.policy.remove -> routing.policy
lrwxrwxrwx 1 vivek vivek   14 Feb  3 00:08 routing.policy.show -> routing.policy
lrwxrwxrwx 1 vivek vivek   14 Feb  3 00:08 routing.policy.status -> routing.policy

测试：

sudo ./routing.policy.add
sudo ./routing.policy.status
traceroute chat.openai.com #<--test routing
sudo ./routing.policy.delete

文章来源：https://www.cyberciti.biz/howto/how-to-skip-chatgpt-from-wireguard-or-openvpn-on-linux/

openai