Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am building a iptables script for a router to block all traffic from and to the machines behind, except a small set of hosts/ports (RDP incoming, DNS outgoing, ...). HTTP and HTTPS is blocked.

Internet --- Router with iptables -+- Windows XP
                                   |
                                   +- Windows XP
                                   .
                                   .

Unfortunately with HTTP/S blocked the Windows Updates are failing. I want the Updates to be working and the surfing to be blocked. These are my thoughts:

  • Setting up a WSUS/Proxy -> Oversized I think, would like to spare another server
  • Getting a list of all Microsoft Update Servers -> Is there any?
  • Getting rid of the Asterisks of the technet dns name list somehow and allow these hosts
  • Maybe a way to do the HTTP-Filtering in with Windows Firewall and separate by service (Win XP SP3)?

Any other thoughts? Maybe someone has already solved this scenario? What would you recommend?

Thanks in advance

share|improve this question
    
windowsupdate.microsoft.com .update.microsoft.com download.windowsupdate.com redir.metaservices.microsoft.com images.metaservices.microsoft.com c.microsoft.com www.download.windowsupdate.com wustat.windows.com crl.microsoft.com sls.microsoft.com productactivation.one.microsoft.com ntservicepack.microsoft.com –  Christopher Wilson Jun 6 '12 at 11:59

1 Answer 1

up vote 1 down vote accepted

Christopher Wilson provided a pretty good list of URLs above.

I would add that WSUS may not be a big deal in the long run. You will most likely still have to define the router whitelist if the goal is to block internet access and surfiing. However, one of the many reasons to implement WSUS is to minimize the impact on the internet connection by only downloading updates once, not to mention it gives you ultimate control over when and which updates to push to clients.

If you already have a database server laying around adding WSUS to an existing box is not too bad and not too much overhead, depending on the number of clients you have.

My suggestion essentially is that you can utilize the list Chris provided to help build out your block policy but also improve your overall desktop maintenance capabilities all while reducing internet bandwidth requirements.

UPDATE: Microsoft URLs to Whitelist:

  • windowsupdate.microsoft.com
  • .update.microsoft.com
  • download.windowsupdate.com
  • redir.metaservices.microsoft.com
  • images.metaservices.microsoft.com
  • c.microsoft.com
  • www.download.windowsupdate.com
  • wustat.windows.com
  • crl.microsoft.com
  • sls.microsoft.com
  • productactivation.one.microsoft.com
  • ntservicepack.microsoft.com
share|improve this answer
    
Unfortunately there is no windows server at all in range, I would have to set up a new VM and install everything :( I forgot to mention in the first place, the ESX is in a datacenter with plenty of unused inclusive traffic. I will try Christopher Wilsons list and get back to WSUS when there are more some clients. Thanks for your answer, Brent –  krissi Jun 7 '12 at 10:15
    
Well, I hit some problems, because the hostnames are resolving to multiple addresses, etc. Too complex to be reliable I think. I switched to the WSUS solution and exposed an existing wsus server to these specific hosts. –  krissi Jun 7 '12 at 13:26

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.