Re: How to setup the MS-windows update roles

Dear Tim,
    Thanks for your reply.


   1. The proxy Allowed standard ports includes port 443 and 80. I checked the proxy log and didn't find the blocked URL,
   2. The proxy setting in internet explorer setting is correct. The web browser works find. Only the windows update failed.
  
Thanks and regards,
Muiz

2016-06-01 01:13:13，"tim moore" <[email protected]> Wrote：
Hi 


Did you enable logging and see if a url is being blocked. Also remember that windows update also uses 443 for the catalog.


443 is not covered by redirection only port 80, make sure you have the proxy details set in the internet access for the pc either through control panel or settings for internet explorer. I will check the list I use for win update and see if you need any others.


Cheers for now



On Tuesday, May 31, 2016, muiz <[email protected]> wrote:
Dear all,
  Thanks for your reply. Below is my detail information:
  I want to let computers in Green network can download updates from Microsoft websites, and cannot access other websites.
  I reference to https://technet.microsoft.com/en-us/library/bb693717.aspx page.

  1. Disabled the network access for all PCs in Firewall -> Firewall Rules screen and it works.
  2. Enable Proxy and Redirectors:  Service -> Proxy page and it works.
      The client PC in Green network can access website after setup the proxy settings.
      Windows can download the update files.
  3. Service -> URL Filter screen,
      3.1 enable URL filter;
      3.2 enable Custom whitelist;
      3.3 Add the following website to Allowed domains list.
                     windowsupdate.microsoft.com
                    *.windowsupdate.microsoft.com
                    *.update.microsoft.com
                    *.windowsupdate.com
                    download.windowsupdate.com
                    download.microsoft.com
                    *.download.windowsupdate.com
                    test.stats.update.microsoft.com
                    ntservicepack.microsoft.com
                   54.69.147.146
                   125.56.199.137
                   ... a lot of IPs ...


      3.4 Save and restart
     Windows cannot download the update files. But can open the Allowed domains.

     Any suggestion?


Thanks and best regards,
Muiz

At 2016-05-28 18:01:44, "G.W. Haywood" <[email protected]> wrote:
>Hi there,
>
>On Sat, 28 May 2016, muiz wrote:
>
>> Does anyone setup the firewall to let the MS Update service through
>> the firewall?
>
>http://www.ipcop.org/2.0.0/en/admin/html/firewall-traffic.html
>
>[QUOTE]
>2.6.2. What traffic is allowed between Interfaces?
>
>The security model of IPCop is that the GREEN network is fully trusted
>and any requests from this network, whether initiated by a user or by
>a machine infected with a virus, Trojan horse or other "malware" is
>legitimate and allowed by IPCop.
>[/QUOTE]
>
>It then goes on to say
>
>[QUOTE]
>A new feature of IPCop 2.0.0, allows to set policies for each network
>interface. This makes it possible to allow only specific traffic to
>RED and IPCop.
>[/QUOTE]
>
>and follows that with tables showing "policies", which I for one find
>rather lacking as the tables do not show the default IPCop settings.
>
>In this page:
>
>http://www.ipcop.org/2.0.0/en/admin/html/firewall-settings.html
>
>Figure 2.44 shows that the default "policy" for the GREEN interface
>will be "open", in which case you should not need to do anything at
>all to permit Windows Update traffic.
>
>If you are talking about Windows Software Update Service (WSUS), it
>uses ports 8530 and 8531 respectively for HTTP and HTTPS connections
>and out of the box IPCop 2.x should allow the traffic because client
>machine initiates it entirely.  Clients may need to be given (via DHCP
>for example) information such as the IP addresses of DNS servers and
>an address for their Internet gateway (presumably an IPCop interface,
>be it GREEN, ORANGE or BLUE) in order to be able to use the service.
>
>If this does not help you, we need more information.  For example it's
>quite possible that your IPCop is connected to the Internet via some
>third-party router which is selectively blocking traffic.
>
>There are numerous settings in IPCop 2.x which you might have changed
>and which might as a result of your changes affect the ability of any
>given client to access external services.
>
>--
>
>73,
>Ged.
>
>------------------------------------------------------------------------------
>What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
>patterns at an interface-level. Reveals which users, apps, and protocols are
>consuming the most bandwidth. Provides multi-vendor support for NetFlow,
>J-Flow, sFlow and other flows. Make informed decisions using capacity
>planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
>_______________________________________________
>IPCop-user mailing list
>[email protected]
>Manage your subscription or unsubscribe
>https://lists.sourceforge.net/lists/listinfo/ipcop-user






------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are
consuming the most bandwidth. Provides multi-vendor support for NetFlow,
J-Flow, sFlow and other flows. Make informed decisions using capacity
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user
------------------------------------------------------------------------------
What NetFlow Analyzer can do for you? Monitors network bandwidth and traffic
patterns at an interface-level. Reveals which users, apps, and protocols are 
consuming the most bandwidth. Provides multi-vendor support for NetFlow, 
J-Flow, sFlow and other flows. Make informed decisions using capacity 
planning reports. https://ad.doubleclick.net/ddm/clk/305295220;132659582;e
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user