1

I have Pc’s on the shop floor that I block access to the internet using ESET cloud protect policy. I need to allow the Pc’s to update ESET and Windows. The ESET bit is easy, just add the ESET update servers to the Allow list in Web access Protection.

On the windows update side however I found a list of windows update server online and added all these to the allow list as well as allowing services DoSvc & wuauserv to communicate through the firewall.

I can only assume that the windows update server are many and varied and may change from time to time

Anyone else tried and succeed in this ?

I tried ESET support and got the reply back

"Thank you for contacting ESET Technical Support.

Unfortunately, the requirements for specific Windows features falls outside the remit of our support."

35 Spice ups
2

You could look into using a proxy server where you configure your pc’s to access the internet only through his server, then set up the server to allow specific URLs. You may also want to look into utilizing WSUS it would fetch updates from and internal server rather than directly from microsoft.

10 Spice ups
3

We are looking at ESET’s patch management and vulnerability functions just now rather than WSUS as it brings a lot of things under the same window.

" set up the server to allow specific URLs" - this is the bit that is stumping me

Windows updates seem to come from a vast array of different servers, I will see if I can find an up to date list and apply them to my exceptions rule in the policy

2 Spice ups
4

Yes, and that list will change based on a great many things.

The best solutions you have already mentioned, would be use a WSUS server, allow access to it. Or use third party patch management products.

I do not think you would ever be able to list them all or be assured they will not change on the fly. This is why a great many firewalls pass all microsoft.com traffic (which is infinitely abusable) I do not advocate that.

6 Spice ups
5

This article is about WSUS, but it would apply to any other system that needs access to Windows Update: Step 2 - Configure WSUS | Microsoft Learn

I am surprised to hear ESET support thinks it’s not their problem to solve!

Here is a list:

http://windowsupdate.microsoft.com

http://*.windowsupdate.microsoft.com

https://*.windowsupdate.microsoft.com

http://*.update.microsoft.com

https://*.update.microsoft.com

http://*.windowsupdate.com

http://download.windowsupdate.com

https://download.microsoft.com

http://*.download.windowsupdate.com

http://wustat.windows.com

http://go.microsoft.com

http://dl.delivery.mp.microsoft.com

https://dl.delivery.mp.microsoft.com

http://*.delivery.mp.microsoft.com

https://*.delivery.mp.microsoft.com

8 Spice ups
6

So though I get this is a need, it is a need that is being attacked from the wrong angle IMHO, and will likely end in two places, misery, or concession.

The problem with that, is that list is not comprehensive, especially depending on edition. If you search TechNet and other sources, you will find references to several others, then it can further depend on applications (windows updates more than windows) like forefrontdl.microsoft.com, or dependent on CDN’s / global load balancers like like update.microsoft.com.akadns.net that are not directly MS servers.

A still not comprehensive list here for windows 10.

And here for windows 11

As well as MS’s own statement “The CDNs in use by Microsoft are always subject to change and in many cases there are multiple CDN partners configured in the event one is unavailable.”

What setting the above short list do for instance is open a many of vectors for attack.
Example, that I have personally used many times in pen testing, you need to get binary data onto a network through a less than permissive firewall.
Do a simple test connect to common microsoft domains that are likely configured with this specific purpose in mind (can be manual or automated)
Find a user content capable URL that resolves to one of the wildcards (since they are all backended by CDN’s as well)
Make a seemingly innocuous post that contains a footer pretending to be something like a pubkey, or PGP key in Base64 masquerading as a “certificate”
Target the URL, it passes, regex out the content, reconstruct, and firewall thinks you are doing updates.
Done right it can be done fully fileless, single line of powershell to execute < 255 chars. (Can provide working example, but previous attempts to do things like that tends to trip a nono with mods)

Similar tactics work on many other blanket passes, like *facebook, *twitter, etc. BUT since updates are so broad and misunderstood, they seldom get audited that granularly. So though while not an exclusive MS problem, the breadth of MS updates and the obscure content delivery pool, make it a virtual impossibility to get into and get it consistently correct. Likewise, it is by far not a secret, there is malware that abuses this very fact as well.

So if you are in a position to need to get this granular on a firewall (which is what justifies this detail of why it likely will not work the way you think) then you are likely in a position to need better patch management or a central update server. as it lowers your egress potential to 1^vectors, not clients^vectors because all of this does not even address the chatty windows outside update infrastructure. OIr the fact as client count grows there is more to an update server / patch management solution that security, hundreds of computers all pulling independent updates direct from the internet is a massive resource drain. So the list goes on and on and on.

3 Spice ups
7

Not sure on the exacts but if Group Policy is in use then creating an OU specifically for the shop floor workstations and allow updates. The state agency I work for now has it set to default to allowing updates for user workstations but blocking updates to instrument workstations since vendor-specific software is dependent on what version of Windows is being ran. Just a thought/option.

2 Spice ups
8

Use a local WSUS server and escalate the issue to ESET’s senior management.

6 Spice ups
9

@chrisdavis8 That is a good solution for a lot of use cases, but it manipulates the client’s tendency to check/process, not the firewall’s permission to allow it to pass. And it implies they have internet access where the OP said they did not and were trying to open it for this purpose specifically.

10

Good point - offering options isn’t my best suit when I’m only on coffee cup #1…

11

Oh its still a good suggestion if the OP decides they way they are attacking that is not they way they eventually want to go. I cannot count the times I came to the table with a determined question and left with an alternate solution! :slight_smile:

12

Another possibility is to use PDQ Deploy to push out the monthly security updates along with any other program updates you need. You can monitor computers to make sure they are up to date with PDQ Inventory. These programs sure have made my life easier.

3 Spice ups
13

That would work @christianrickman . I’ve included an article on using our products on air-gapped networks and on installing updates with PDQ Deploy. Hope that helps!

2 Spice ups
14

I’ll upvote that!
We love our PDQ, likely the most used admin tool we employ.

2 Spice ups
15

So in summary

I would be fighting a losing battle trying to make exception in my ESET firewall to allow windows updates. I think WSUS is probably the way to go

Thanks for all your suggestions

1 Spice up
16

Hi, had similar woes with shop floor PC’s, you may also find that without WSUS, even if you got the firewall to allow updates the PC users on shop floor wont have rights to install them. It’s a PITA, basically you are forced into using WSUS. But should the users have admin rights then the easiest solution would be to put the block policy on a schedule, so that weekends there is internet access and updates could happen. Haven’t done this myself, the scrotes on the shop floor would probably be mining crypto all night if they had admin rights

17

“the scrotes on the shop floor”

BigPercy - So you have met the shopfloor workers at my place :slight_smile:

Unfortunately we are pretty much 24/7 so there is not quiet time to allow internet access.

At the moment, I move the PC from a policy in ESET that blocks internet access to one that allows it, connect to the PC via TightVNC and run the updates.

The PC’s are solely used for time recording so I can safely connect without upsetting anyone

2 Spice ups
18

Attached is a list I’ve used with Eset and it seems to work. You should be able to import it into Eset

880d73f7-f3fb-4958-90c9-41510adccf88-export.txt (723 Bytes)

1 Spice up
19

I think from all the comments etc, WSUS is the correct solution for you here, it takes any requirement for the endpoints to connect to the internet out of the picture.

1 Spice up
20

This is exactly what we do in the same situation. When dealing with vendors I enjoying seeing the reaction to the information that I manage more computers that have 0 internet access than do.