Pfsense for secure MS defender updates
-
I need to configure pfSense to allow a Windows host to download only Microsoft Defender signature updates while blocking all other Internet access.
My requirement is:
The Windows host should be able to update Microsoft Defender security intelligence/signatures successfully.
All other Internet access from the Windows host must remain blocked.
I prefer a pfSense-only solution using firewall rules, aliases, or other built-in pfSense features.
The solution should account for Microsoft Defender update servers using dynamic IP addresses, FQDNs, and CDN infrastructure.Can anyone suggest a secure and reliable pfSense configuration to achieve this requirement? If possible, please provide the required aliases, firewall rules, and rule order.
-
There is probably just one person, no .. a company, that knows the list with IPs used by these Microsoft Defender service on your PC : the creator of the OS, it's Microsoft.
So, ask your question to Microsoft, as they own / manage these servers that host these files ?!Now ask yourself another question :
In another world, where you were the main admin of Microsoft, would you publish this list ?
There is are some nice quality video's out there that explains you why they would never do that.Also : Microsoft is like me and you : everybody wants to hide the IPs we/they are using ^^
I'm not saying a 'Microsoft' IP lists do exist : What is the Microsoft ASN number ?
When you have the ASN number(s), you can find the related networks = IP lists.
But these are all the Microsoft IPs, not only the "defender" servers. Also their web sites, OS update servers, Outlook mail servers, all azure stuff, etc etc. A Many million IPs. -
Ok Understood.
What about using WSUS server for Secure updates through pfsense?Is there any limitation?
-
@abarna you prob looking for something like this
But its not going to be a list of IPs, it will be fqdn that you need to allow through your proxy.
-
But this have limitation, FQDN or URL will change dynamically .This will not help fully, I think.
Dynamically using WSUS server , is it possible i am asking?
-
@abarna https://learn.microsoft.com/en-us/troubleshoot/mem/configmgr/update-management/deploy-definition-updates-using-wsus
as to the urls - this is why they give domains, ie wildcard listing anything.domain.tld - you would allow those in your proxy, but not say www.otherdomain.tld
-
@abarna said in Pfsense for secure MS defender updates:
But this have limitation, FQDN or URL will change dynamically .This will not help fully, I think.
Dynamically using WSUS server , is it possible i am asking?
Processes like windowsupdate, licence-checker, defender, send-back-telemetry, get-loads-of-taskbar-publicity, pilot-spyware, etc mostly use FQDN.
These FQDN don't point to Microsoft directly, but point to proxies, the CDN's. You have to handle the IPs of these CDNs also, although the CDN used by Microsoft are probably owned by Microsoft = in their ASN.Why a FQDN ? This permits Microsoft to take down a some of them, and bring others up.
This simplifies the maintenance on their side.
It creates also what you would call a "moving target". This makes DDOSsing them way harder, as the destination IP can change every moment. If someone decides to DOS 'Microsoft', we can still user their services, as Microsoft simply disables server that become overloaded, and open other ones on the fly. No one can reach all their IP at the same moment, as they own to much IPs. And things will be way better with IPv6 ^^
It also makes 'blocking' them very hard.Btw : not only Microsoft works like this, Google, Facebook, Apple etc etc all do the same thing. They have hired the smartest network admin and asked them to do one thing : "whatever happens, make sure our clients (no sorry, "our $$$$$ revenue") can always reach us".
-
WSUS is too much hassle just for that, and domain whitelisting is a PITA. MS does support distributing Defender updates via UNC path, so you could script the tool they provide to have one of your online servers grab updates every hour and create a GPO or two to point your lan clients at the share for their updates.
-
Windows Server Update Services (WSUS) deprecation
Just allow TCP 7680 from Windows PC to Windows PC.Note: If you have multiple VLANs, you can create a rule allowing that, also. It will work.
-
@mcury WSUS will still be supported until 2035 or something. They're not updating it or adding any new features, but they're not killing it any time soon.
-
@KOM said in Pfsense for secure MS defender updates:
WSUS will still be supported until 2035 or something. They're not updating it or adding any new features, but they're not killing it any time soon.
But why bother using WSUS if you can just use Delivery Optimization?
Why bother configuring proxies, URLs, and dynamic IPs?I personally find it much easier to just allow port 7680 between Windows computers.
-
@mcury I wouldn't use WSUS for this but I'm not sure that your solution would work. My understanding of delivery optimization is that the clients on your LAN don't auto-discover and audit each other, they get a master list of resources from an MS server. So it isn't "Hey LAN, does anyone already have this?" It's "Hey Microsoft, does anyone on my LAN already have this?" The clients still need Internet access. I could be wrong as I've never really used that feature but I did read up on it awhile back.
-
@abarna not sure of your use case here - is this business setup? Just some pc in your home?
Links I provided give the info you need to allow defender to update, etc. But you would need to be running the proxy for at least this device. You could setup your rules so it can only talk to the proxy, and no have direct access to the internet, only through the proxy. And then proxy only allows it to talk to what you allow for defender, etc.
As to other methods of managing defender - there are multiple ways. But in a business they would require licensing..
The suggested of wsus or just delivery opt might be viable options for you. Delivery opt could be the really simple way to keep this machine updated as long as you have other windows machines on your network that update.. I know for sure my work laptop is constantly looking on the network for this option ;) I have it isolated in a vlan so it can not talk to any of my other devices, let alone my windows machine. Nor any of the other 2 mini machines I have running windows.
-
@KOM said in Pfsense for secure MS defender updates:
The clients still need Internet access.
To be honest, I don't know how it works under the hood, but it seems that the Internet is only required to get the coordinate list from Microsoft; the actual multi-gigabyte update files are transferred locally PC-to-PC over the LAN.
Microsoft Delivery Optimization: Implementation, Benefits, and Recommended Practices
-
@mcury True, but then each client needs to reach out to MS to get the list so you're right back where you started.
-
@KOM said in Pfsense for secure MS defender updates:
@mcury True, but then each client needs to reach out to MS to get the list so you're right back where you started.
Import this as an alias, allow ports 80 and 443 outbound to these IPs.
Microsoft Public IP SpaceAlso, open TCP 7680 (for data transfer) and UDP 3544 (for Teredo/peer discovery across NATs/VLANs) both inbound and outbound between Windows computers and across VLANs.
UDP 3544 also required?
Configure Delivery Optimization (DO) for Windows -
Business setup, Pfsense hsot machine connected to multiple client Machine
-
@abarna said in Pfsense for secure MS defender updates:
configure pfSense to allow a Windows host to download only Microsoft Defender signature updates while blocking all other Internet access.
prefer a pfSense-only solution using firewall rules, aliases, or other built-in pfSense features.
account for Microsoft Defender update servers using dynamic IP addresses, FQDNs, and CDN infrastructure.
@johnpoz said in Pfsense for secure MS defender updates:
you prob looking for something like this
https://learn.microsoft.com/en-us/defender-endpoint/streamlined-device-connectivity-urls-commercial?tabs=Windows
@abarna said in Pfsense for secure MS defender updates:
But this have limitation, FQDN or URL will change dynamically .
Microsoft can / does constantly update the IP addresses their FQDN resolve to however for that system to work for clients the old IP addresses must continue to work until all clients DNS have updated their records.
For black / white list filtering to work on a boarder firewall,
- The boarder firewall must include the most current and historical IP in the filtering alias
- The boarder firewall must be the DNS for the clients (to ensure the IP used by the clients is the same as the IP filtered by the boarder firewall)
Realising 1. in pfsense is one of the reasons why I proposed a solution to filterdns bugs which enabled aliases to including historical IP for a settable duration
Privacy Policy · Cookie Policy