Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 6 replies
  • Answers 2 answers
  • Subscribers 30 subscribers
  • Views 3859 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Exclude Windows Update from Data Transfer Limits

DJ Hay

Hi

I work at a home for orphaned and abandoned children. We have a few PCs for the children to use and have a Sophos XG Firewall. The children have Sophos user accounts so that we can implement policies for the children. We also implement surfing and network traffic quotas.

Unfortunately, Windows Updates consume significant network traffic. If Windows Updates occur while one of the children is using a computer, it will consume all of their allowed network traffic.

In the past I have disabled the Windows Update service so that updates do not occur automatically when the children are using the computers. At a time when the children are not using the computers, I have logged into the computers with an admin account, started the Windows Update service, completed any available updates, then disabled the Windows Update service.

However, it seems that the Windows Update service can no longer be kept disabled. There have been several workarounds for this but it seems Microsoft keeps defeating these.

So if I cannot prevent Windows Updates occurring when the children are using the computers, then is there any way I can configure the XG firewall so that the data transferred for Windows Updates is not counted towards the children's Network Traffic quotas?

Thanks

David



This thread was automatically locked due to age.
Parents
  • 0

    Hi David,

    Are you able to create a separate user firewall rule specifically for Windows Update destined traffic, that bypasses data accounting?

    Matching URLs for destination network (taken from the Web Exceptions):

    Refer to this KBA - Sophos Firewall: How to allow destination hosts after exhausting network data quotas

    Network traffic quota KBA for reference aswell.

    Regards,

  • 0 in reply to FloSupport

    Thanks FloSupport and M8ey for the suggestions. Sorry it has taken a while to respond. It has taken a while to try things and see if they work. 

    The idea of bypassing the data accounting looked really promising as the updates could still download while the children use the computers without me needing to go in separately and do the updates. Unfortunately, this did not work. While some of the Windows Update requests go to the URLs specified by FloSupport, Windows Update also makes use of many other URLs.

    Looking at firewall reports, I can see a lot of data that Sophos classifies with Application Category of Software Update and Application of Windows Update coming from other places that look like servers operated by telcos and web hosting providers in South Africa (where I am located) and even Europe. This accounts for most of the Windows Update traffic so it still gets counted towards children's data use. Even when I add some of the addresses being used, others pop up and I cannot hope to manage all the possible locations Windows Update may use.

    However, seeing how the Sophos reports show the Application Category of Software Update and Application of Windows Update, this gave me another idea. What I have done is update the firewall rule used to control the children's access, to add the Application of Windows Update to the Application Filter Policy that blocks access to certain applications. This seems to be working.

    While this is not as good an outcome as just excluding Windows Updates from data accounting, it does prevent Windows Updates from downloading while the children are using the computers.

    Is there a way to set up a rule so that data transfers for the Application of Windows Update are allowed but excluded from data accounting, while still having Web and Application Filter Policies that blocks other activity? I am not sure how Sophos knows that these data transfers are for the Application of Windows Update.

  • 0 in reply to DJ Hay

    Hi  

    Unfortunately like you experienced, this won't be possible without configuring the bypass rule to match to all possible Windows Update IP's.

    However if you are inclined enough, you could setup a WSUS server in your home network? That way, only this server would go out to grab Windows Update files and your clients would get their updates locally (bypass LAN-LAN traffic from data accounting).

    Regards,

  • 0 in reply to DJ Hay

    Hi David Hay,

    I thought you should know about the option within Windows 10 to download windows updates from local sources.

    just google it, and there are loads of site which can let you know how to.

  • 0 in reply to FloSupport

    As suggested WSUS would be your best way to control this traffic, plus it would lower overall WAN usage in theory as it would be this server downloading from the WAN and everything else is local traffic if configured correctly.

Reply Children
No Data