Windows update firewall issue

Just putting this out there in case someone else is stuck. The symptom is that Windows Update just stops working. You may not find out about this until your PC complains that it hasn’t been updated for x weeks. In fact, depending on your version of Windows, you may not know unless you actually check the date of the last update.

I get a variety of error codes, all of which boil down to some networking problem (check DNS, etc.) and none of which are actually helpful. The real problem is that the windows firewall is blocking traffic from my router to my PC. For reasons that are beyond my discovery, windows update (and microsoft update) generates traffic from my router to my PC. The source of the traffic actually is the router, not just outside traffic passed through.

So, the fix is:

  • Prepare your geek resources. If you’re not comfortable poking around in firewall rules, go out to the forest and capture a geek.
  • Find out the IP address of your router. Often this is printed on the bottom of an ADSL router and will be something like 192.168.1.1
  • Enable logging of dropped packets in your firewall. I’m not going to tell you how to do this as there are too many variations, so you’ll have to look it up. Just a tip, though – if you’re using Windows built-in firewall, make sure you enable logging for the active profile (usually the private profile).
  • Kick off an update
  • Look in the logs for dropped packets with the router’s address as the source address. Make a note of the port and protocol (e.g. UDP port 2048).
  • Add a rule to the firewall (again, use the active profile) to allow that traffic.

The final twist is that the port may change when the router is rebooted. So unless you want to just allow all traffic from the router, you need to keep an eye on this. For a long time I only saw ports 2048 and 2049, but just lately it’s flipped over to 2051.

Not an especially straightforward fix for something as fundamental as windows update. It’s a disturbing thought that for a user without reasonable tech skills, this problem basically just disables updates, invisibly and permanently. I have found absolutely no mention of this anywhere on the net. Maybe nobody else has this problem – but I’ve seen it with two different routers, four different PCs and three different Windows versions.

I’d be intrigued to know if anyone has any insight into the cause. I can only guess there’s some sort of link monitoring, QoS heartbeat or some such going on. I have found port 2048 mentioned in a list of well-known ports as “dls-monitor”, but no luck finding out what that means.

Leave a Reply

Your email address will not be published. Required fields are marked *