What Firewall Rules Will Allow Windows Update and ONLY Windows Update to Work For Windows 8.1? If that is not possible please provide the minimum rules necessary and the names of the additional program(s)/service(s) that must be granted access.
I debugged this problem for hours. In the end, to get Windows Update through Windows firewall you must allow svchost. You cannot narrow the protocol, scope, application packages or services.
So I have 0 inbound firewall rules, and 3 outbound firewall rules two of which are active at any point in time. Those rules are:
WFC - Core Networking - Dynamic Host Configuration Protocol (DHCP-out)
AND Other applications that require internet (i.e., your web browser)
To connect to the internet, I must turn on 1 and 3. After I can turn off 1 and 3 and turn on 2. If my internet is on, and I want to use windows update, I then disable 2 and enable 1. That means after I have connected to the internet and don't plan on using windows update that the only weakness in my firewall is my browser assuming I haven't added any other exceptions.
So far it doesn't look like windows firewall actually performs the functions it offers, blocking individual services under the umbrella of the svchost. Microsoft releases windows updates every second Tuesday of each month give or take 24 hours or so. You could create a script that automatically enables svchost out each month, and one for every day for defender updates; (for 5-10 minutes) or do it manually.
Or, you could for example block everything, enable packet logging, monitor the ip addresses and ports for every windows update server connection, then only allow svchost out for those specific ip addresses, this will narrow it down to only allow windows update. If you use cidr format replacing the last 3 digits with .1/24, you will be able to reach every ips on that subnet if they change over time. After hammering this out enough, should you notice other ip's pop up outside that scope, you will over time know its not windows update. I am not sure how one can detect exactly what program/service is operating under the svchost umbrella other than triggering it manually.
For Windows Updates, use Group Policy "Delivery Optimization" Download Mode, set to 99, (meaning no P2P or cloud services, just microsofts servers alone; so you don't get 1,000,000,000 different ips) Then you must create a blacklist for each ip that comes up through svchost that does not involve windows update.
Remote addresses: 184.108.40.206/24,220.127.116.11/24,18.104.22.168/24,22.214.171.124/24,126.96.36.199/24,188.8.131.52/24,184.108.40.206/24,220.127.116.11/24,18.104.22.168/24,22.214.171.124/24,126.96.36.199/24,188.8.131.52/24,184.108.40.206/24,220.127.116.11/24
This worked for me. [Using WFC a Windows Defender Firewall Front End GUI]