Why do I need to connect to the VPN to use JupyterHub?

In a nutshell: Security.

We need to make sure that JupyterHub is reliable and available, and that the data on it (your work) is kept private and is not tampered with. 

Computers that are exposed to the public internet (as opposed to a private network) can be  attacked by anyone on the planet with an internet connection – and this happens constantly. . Basic monitoring shows that attacks against NC State systems occur with great frequency from sources worldwide. We routinely log thousands of attempted connections per hour on systems on the public Internet.

It is standard practice both in higher education and in the private sector to place computing resources that are not technically required to be publicly available (such as web servers) on private networks. Most computer systems at the university are protected in this way, including application, file, and print servers as well as ordinary office and lab computers.

This does not eliminate attacks, but reduces the “attack surface” – far fewer people can attack a system on our private network (on the order of tens of thousands) than on the Internet (on the order of hundreds of millions) – and we know who is connecting to our network since login is required.  It is an important part of good security practice.

For JupyterHub, this means that we give the server a private network address that can only be reached from the NC State campus. This is similar to the way your home Internet works when you use a wifi router – the outside world cannot access your computer directly.

Obviously, that is not helpful if you are off campus! 

So, NC State provides VPN software that you can use on your own computer to allow you to connect to the NC State private network.

This means that you need to install the Cisco AnyConnect software on your computer and log in to the VPN prior to accessing JupyterHub. Because NC State requires 2FA (two-factor authentication), you will also need to use Duo when you log in.

It adds a level of inconvenience, but it protects your work and your access to the JupyterHub server by preventing the server from being hacked or compromised. That really would be inconvenient!