Search code examples
azureazure-web-app-serviceopenai-apiazure-virtual-networkazure-webapps

Azure web app has no access to openai private endpoint in virtual network

I am trying to host a web application similar to a private ChatGPT instance within a secluded virtual network, ensuring that there's no external internet access.

I have developed a web application that serves as the interface for the OpenAI API, where the API itself is utilized for ChatGPT functionality. To achieve privacy, I established a virtual network and set up private endpoints for both components. As a result, the Webapp resides at 10.0.0.5, while the OpenAI API is located at 10.0.0.6. Furthermore, I configured a virtual machine (VM) with a Bastion to gain access to my private web application. This setup has been functioning seamlessly thus far. The Chat feature within OpenAI Studio exclusively operates within the confines of my private network (via the Bastion VM), and I can only interact with my web application when connected to the VM. Any attempt to access the web app from the public internet results in a "403 Forbidden" error. Similarly, accessing OpenAI Studio from the public internet prompts the message "Public access is disabled. Please configure private endpoint," which is the intended behavior.

However, I've encountered an issue: even with internet access restricted and proper access via the virtual network on my VM, attempting to use the question feature in my web application within the private network leads to the same "Public access is disabled. Please configure private endpoint" error. Strangely, the chat functionality in OpenAI Studio works flawlessly. There seems to be a specific obstacle affecting my web app's functionality.

So i would like to ask if someone has an idea how to solve this.

//EDIT: This is what my private network looks like enter image description here

Now i made a few changes and seems like im a step further. Now if im requesting the OpenAI from my WebApp, it tells me "Access denied due to Virtual Network/Firewall rules."

Solution

  • The fix was to create another subnet and activate the vnet integration in the web app and link it to the created subnet. enter image description here