What firewall changes are required to download Windows updates?

Question

I have a Windows 2019 server sitting behind a firewall and an Internet proxy.

What are the network ports and URLs that need to be whitelisted for this server to download Windows patches/updates from the Internet?

Answer 1

Ports: tcp/80 and tcp/443

Urls:

http://windowsupdate.microsoft.com

http://*.windowsupdate.microsoft.com

https://*.windowsupdate.microsoft.com

http://*.update.microsoft.com

https://*.update.microsoft.com

http://*.windowsupdate.com

http://download.windowsupdate.com

https://download.microsoft.com

http://*.download.windowsupdate.com

http://wustat.windows.com

http://ntservicepack.microsoft.com

http://go.microsoft.com

http://dl.delivery.mp.microsoft.com

https://dl.delivery.mp.microsoft.com

These will work for a proxy server. Not sure about the firewall. Many firewalls allow access to address ranges, not urls. Products such as Office 365 have deterministic IP addresses, although those may still change occasionally.

https://docs.microsoft.com/en-us/windows-server/administration/windows-server-update-services/deploy/2-configure-wsus