webfilter transparent mode - ausnahmen für Windows Update

Question

Hallo, 
 ich habe einen WSUS ohne Speicher installiert >> clients m&uuml;ssen updates selbst downloaden 
 Auf der UTM9 ist der Webfilter im transparent mode aktiv, ausgew&auml;hlte Rechner d&uuml;rfen surfen >> zugelassene Netzwerke >> geht 
 Die PCs (teils noch Win7) die nicht in zugelassene Netzwerke eingetragen sind sollen jedoch die Windows updates downloaden d&uuml;rfen. 
 Daf&uuml;r habe ich eine Firewallregel die den http/https verkehr zu MS erlaubt. Mein Problem ist, das ich keine updates bekomme, da anscheinend der Verkehr durch den Proxy geleitet wird und geblockt wird. 
 Hat jemand eine idee wie ich das umsetzen kann?

ThomasBachmaier · Answer

Hi, 
 wie verteilst Du den Proxy? &uuml;ber WPAD? Dann kannst Du mit if (shExpMatch(url,"*.windowsupdate.com/*")) { return "DIRECT"; } erreichen dass der Verkehr zu den Windowsupdates nicht &uuml;ber den Proxy sondern direkt &uuml;ber die Internet Verbindung geht. Evtl. musst Du auch auch noch die Domain microsoft.com hinzuf&uuml;gen. 
 Ansonsten einfach an dem Rechner den Proxy entfernen, da er ja eh nicht in Internet darf braucht er auch keinen Proxy. 
 Gr&uuml;&szlig;e 
 Thomas

DouglasFoster · Answer

I understand your problem is as follows: 
 
 You have a group of PCs that do not use web filtering at all, because their IP addresses are not in the Allowed Networks list of any Filter Profile 
 You have also added firewall rules to block those PCs from most access to the Internet. 
 You have tried to add firewall rules to allow them to have access to Windows Update, but it does not appear to be working. 
 
 The Firewall Rules can only examine IP addresses, not URLs. Major services like Windows Update use lots of IP addresses, so firewall exceptions will never work. 
 Web Filtering is based on URL, not IP address, so it provides much more flexibility. 
 Several options: 
 
 Buy a big disk and configure WSUS Windows caching on your WSUS server, so that your restricted PCs do not need access to Microsoft. 
 Enable Web Filtering for your restricted PCS, and then block most Internet access using a restrictive Filter Action. 
 
 Notes: 
 
 UTM comes with a web filtering exception for *.windowsupdate.com and *.microsoft.com, which will allow your Windows Updates, although it will also allow other things that you pdo not want, such as live.microsoft.com. You will need to disable this rule if you want to configure something more restrictive. I cannot tell you what the more restrictive rule should be; it will require testing. 
 
 Be aware that Windows 10 has two update methods: WSUS/WindowsUpdate and Windows Store. Major operating system updates are delivered in Windows Store mode, bypassing WSUS completely. 
 
 Windows Updates are not the only updates to consider. You probably need updates for Google Chrome, Adobe Reader, your AntiVirus product, and possibly Java. UTM has supplied rules for some of these sites as well. You need to evaluate which updates to allow, and then ensure that you have working exceptions for everything that you want to allow.