jupyter notebook 的 iptables 规则

Question

having trouble with the iptables setting for jupyter notebook. with the following rules (assume notebook port 8888), jupyter notebook server would be launched successfully, but the actual notebook kernel would fail to start/establish.

by commenting out the last iptables rule "-A OUTPUT -j DROP", everything works fine.

any thoughts?

-A INPUT -p tcp -m state --state NEW,ESTABLISHED --dport 8888 -j ACCEPT
-A INPUT -p tcp -m state --state ESTABLISHED --sport 8888 -j ACCEPT
-A OUTPUT -p tcp -m state --state ESTABLISHED --sport 8888 -j ACCEPT 
-A OUTPUT -p tcp -m state --state NEW,ESTABLISHED --dport 8888 -j ACCEPT
-A INPUT -j DROP
-A OUTPUT -j DROP

Answer 1

Often tools like jupyter use the loopback device (localhost) to access certain features. For example, jupyter has a frontend that communicates over HTTP with the notebook server, which sends messages via sockets to the IPython Kernel (see: https://jupyter.readthedocs.io/en/latest/architecture/how_jupyter_ipython_work.html ).

I would add the following rules:

sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

These rules allow input and output to and from the loopback device (localhost).

Answer 2

The above answer is the right fix however the documentation pointed to is broken, the current documentation about Jupyter client's communication with IPython kernel is updated here: https://jupyter-client.readthedocs.io/en/latest/messaging.html

Additionally this is the correct order of adding iptable rules for anyone struggling with this:

iptables -A INPUT -p tcp -m state --state NEW,ESTABLISHED --dport 8888 -j ACCEPT
iptables -A INPUT -p tcp -m state --state ESTABLISHED --sport 8888 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state ESTABLISHED --sport 8888 -j ACCEPT
iptables -A OUTPUT -p tcp -m state --state NEW,ESTABLISHED --dport 8888 -j ACCEPT
iptables -A INPUT -i lo -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A INPUT -j DROP
iptables -A OUTPUT -j DROP

iptable rules exist as chains. Incoming, Outgoing, and Pass-through packets are examined one rule at a time in the corresponding chain, and are handled based on the first rule that's matched. With the above ordering, packets with loopback address are allowed to go through freely, but all other traffic is blocked. This blocks pip installs, apt-updates, telnet, netcat etc.