Block the entire LAN from doing "windows update" and only allow the WSUS servers
cfabre last edited by
I would like to block the entire LAN from doing "windows update" and only allow the WSUS servers to do this.
Is it possible to do this only with Aliases and Rules? I do not use Proxy!
Aliases Name: WSUS_Aliases
PS: Does pfsense understand what an asterisk is?
Protocol: TCP Source: WSUSSevers AND Destination: WSUS_Aliases AND Destination Port 80, 443 PERMIT
Protocol: TCP Source: LAN_Subnet AND Destination: WSUS_Aliases AND Destination Port 80, 443 BLOCK
Not with only aliases and rules. Those destinations are going to resolve to many, many IPs and if you create an alias using them each will only have a single IP. And, no, you can't use an asterisk like that.
The only way I could imagine doing that is blocking them using DNS with pfBlocker. Allow the WSUS servers to use a different DNS server so it can resolve them.
I can imagine blocking download.microsoft.com might cause other issues though.
bmeeks last edited by bmeeks
You should use GPO (Group Policy Objects) to accomplish this on the Windows clients themselves. Here is a Microsoft article to get you started. There are many other tutorials to be found with a Google search.
In my personal opinion, attempting to accomplish this with DNS blocking or firewall rules is a recipe for extreme frustration. You will wind up breaking a lot of other needed services with IP lists that are too broad.
Yup. And if you find anyone bypassing your GPO somehow, grab a wrench and go pay them a visit.