需要在防火墙中打开哪些主机名和端口才能使Windows更新正常工作？

我们在防火墙后面有一组公共Web服务器,我们希望能够执行 Windows更新,而不会为他们提供超出需要的访问权限.

除了www.update.microsoft.com:443,还需要取消阻止哪些其他主机名和端口才能使Windows更新正常工作？

从 http://technet.microsoft.com/en-us/library/cc708605(WS.10).aspx开始这就是让WSUS通过防火墙工作所需要的(如果你有超过10个客户端,你肯定应该考虑恕我直言).对于访问MS服务器的常规客户端框,这应该是相同的.

Configure the Firewall Between the WSUS Server and the Internet

If there is a corporate firewall between WSUS and the Internet,you might need to configure the firewall to ensure that WSUS can obtain updates.

To configure your firewall

• If there is a corporate firewall between WSUS and the Internet,you might need to configure that firewall to ensure that WSUS can obtain updates. To obtain updates from Microsoft Update,the WSUS server uses port 80 for HTTP protocol and port 443 for HTTPS protocol. This is not configurable.

• If your organization does not allow those ports and protocols open to all addresses,you can restrict access to only the following domains so that WSUS and Automatic Updates can communicate with Microsoft Update:

  • 07001
  • http://*.windowsupdate.microsoft.com
  • https://*.windowsupdate.microsoft.com
  • http://*.update.microsoft.com
  • https://*.update.microsoft.com
  • http://*.windowsupdate.com
  • 07002
  • 07003
  • http://*.download.windowsupdate.com
  • 07004
  • 07005

The steps for configuring the firewall above are meant for a corporate firewall positioned between WSUS and the Internet. Because WSUS initiates all its network traffic,there is no need to configure Windows Firewall on the WSUS server. Although the connection between Microsoft Update and WSUS requires ports 80 and 443 to be open,you can configure multiple WSUS servers to synchronize with a custom port.