1) disabled http proxy because itunes update did not work. iTunes could connect to iTunes store
2) added nat rule which masquerades internal to external network
3) added paketfilter which permits any-2-any (permit everything)
...and then iTunes could not connect to iTunes store.
XPSP2 and iTunes 7