Block Windows 10 P2P updates with a corporate firewall
I work for a small IT company that fix mostly Windows computers, and lately we have an huge issue with Windows 10 updates.
When a new computer enters our network and starts downloading updates, it block internet for every other PC.
I've read that this is because of the new P2P mode, and if I manually disable that, in fact, it works.
But I can't manually disable a setting on every client pc everytime a new customer brings his pc.
Is there a way to block this behaviour with a firewall? I'm running Ubuntu Server with FireHol to manage internet inside my network, and currently I didn't setup any QoS since we have plenty of bandwidth and when we download something on a computer we would like to do that at full speed.
Any thoughts?
networking windows-10 firewall windows-update iptables
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
|
show 1 more comment
I work for a small IT company that fix mostly Windows computers, and lately we have an huge issue with Windows 10 updates.
When a new computer enters our network and starts downloading updates, it block internet for every other PC.
I've read that this is because of the new P2P mode, and if I manually disable that, in fact, it works.
But I can't manually disable a setting on every client pc everytime a new customer brings his pc.
Is there a way to block this behaviour with a firewall? I'm running Ubuntu Server with FireHol to manage internet inside my network, and currently I didn't setup any QoS since we have plenty of bandwidth and when we download something on a computer we would like to do that at full speed.
Any thoughts?
networking windows-10 firewall windows-update iptables
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00
|
show 1 more comment
I work for a small IT company that fix mostly Windows computers, and lately we have an huge issue with Windows 10 updates.
When a new computer enters our network and starts downloading updates, it block internet for every other PC.
I've read that this is because of the new P2P mode, and if I manually disable that, in fact, it works.
But I can't manually disable a setting on every client pc everytime a new customer brings his pc.
Is there a way to block this behaviour with a firewall? I'm running Ubuntu Server with FireHol to manage internet inside my network, and currently I didn't setup any QoS since we have plenty of bandwidth and when we download something on a computer we would like to do that at full speed.
Any thoughts?
networking windows-10 firewall windows-update iptables
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
I work for a small IT company that fix mostly Windows computers, and lately we have an huge issue with Windows 10 updates.
When a new computer enters our network and starts downloading updates, it block internet for every other PC.
I've read that this is because of the new P2P mode, and if I manually disable that, in fact, it works.
But I can't manually disable a setting on every client pc everytime a new customer brings his pc.
Is there a way to block this behaviour with a firewall? I'm running Ubuntu Server with FireHol to manage internet inside my network, and currently I didn't setup any QoS since we have plenty of bandwidth and when we download something on a computer we would like to do that at full speed.
Any thoughts?
networking windows-10 firewall windows-update iptables
networking windows-10 firewall windows-update iptables
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
asked Apr 8 '16 at 8:10
JohnKillerJohnKiller
11311
11311
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00
|
show 1 more comment
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00
|
show 1 more comment
1 Answer
1
active
oldest
votes
If it downloads via non SSL connection you can setup a proxy cache like squid.
Then you have a local server that won't go through the internet.
Hopefully you have gigabit locally so it won't bog down your local network.
Second if you can place your client PC's on their own subnet then:
iptables -i eth0 (or etc) -s 192.168.100.1 -d ip/ms server name -j DROP
Setup your own PC with P2P for Windows 10 updates on so that it fetches updates from there instead of going to the internet. You can use iptables IP/port forwarding to forceable re-direct said update traffic to your local Windows 10 PC with P2P turned on.
If you have separate subnets for clients/work PC you can QoS just the appropriate subnet or just QoS the microsoft update server.
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1062923%2fblock-windows-10-p2p-updates-with-a-corporate-firewall%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
If it downloads via non SSL connection you can setup a proxy cache like squid.
Then you have a local server that won't go through the internet.
Hopefully you have gigabit locally so it won't bog down your local network.
Second if you can place your client PC's on their own subnet then:
iptables -i eth0 (or etc) -s 192.168.100.1 -d ip/ms server name -j DROP
Setup your own PC with P2P for Windows 10 updates on so that it fetches updates from there instead of going to the internet. You can use iptables IP/port forwarding to forceable re-direct said update traffic to your local Windows 10 PC with P2P turned on.
If you have separate subnets for clients/work PC you can QoS just the appropriate subnet or just QoS the microsoft update server.
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
add a comment |
If it downloads via non SSL connection you can setup a proxy cache like squid.
Then you have a local server that won't go through the internet.
Hopefully you have gigabit locally so it won't bog down your local network.
Second if you can place your client PC's on their own subnet then:
iptables -i eth0 (or etc) -s 192.168.100.1 -d ip/ms server name -j DROP
Setup your own PC with P2P for Windows 10 updates on so that it fetches updates from there instead of going to the internet. You can use iptables IP/port forwarding to forceable re-direct said update traffic to your local Windows 10 PC with P2P turned on.
If you have separate subnets for clients/work PC you can QoS just the appropriate subnet or just QoS the microsoft update server.
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
add a comment |
If it downloads via non SSL connection you can setup a proxy cache like squid.
Then you have a local server that won't go through the internet.
Hopefully you have gigabit locally so it won't bog down your local network.
Second if you can place your client PC's on their own subnet then:
iptables -i eth0 (or etc) -s 192.168.100.1 -d ip/ms server name -j DROP
Setup your own PC with P2P for Windows 10 updates on so that it fetches updates from there instead of going to the internet. You can use iptables IP/port forwarding to forceable re-direct said update traffic to your local Windows 10 PC with P2P turned on.
If you have separate subnets for clients/work PC you can QoS just the appropriate subnet or just QoS the microsoft update server.
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
If it downloads via non SSL connection you can setup a proxy cache like squid.
Then you have a local server that won't go through the internet.
Hopefully you have gigabit locally so it won't bog down your local network.
Second if you can place your client PC's on their own subnet then:
iptables -i eth0 (or etc) -s 192.168.100.1 -d ip/ms server name -j DROP
Setup your own PC with P2P for Windows 10 updates on so that it fetches updates from there instead of going to the internet. You can use iptables IP/port forwarding to forceable re-direct said update traffic to your local Windows 10 PC with P2P turned on.
If you have separate subnets for clients/work PC you can QoS just the appropriate subnet or just QoS the microsoft update server.
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
answered Jan 22 at 17:53
cybernardcybernard
10.4k31628
10.4k31628
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1062923%2fblock-windows-10-p2p-updates-with-a-corporate-firewall%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Some articles on the internet say that the service uses port 3544 and 7680 for the communication. Blocking those ports might work but it's not sure. If you allow just one client to take the full bandwidth, then the other clients won't have any. Are you sure the problem isn't there? P2P is mostly used for upload and not download.
– Spokey
Apr 8 '16 at 9:04
It blocks internet for every other PC? Looks like you may need to enable some additional QoS rules or bandwidth sharing / limiting rules so one computer cannot use all available bandwidth leaving the rest with none
– Jeff
Apr 8 '16 at 10:24
If they are connected to the network wirelessly, see this...lifehacker.com/…
– Moab
Apr 13 '16 at 17:22
@Jeff it blocks even internal network, literally everything. it's a pain. Fun fact: if a computer in my network starts torrent, i have not this issues. other PCs slows a bit, but still works
– JohnKiller
Apr 19 '16 at 8:57
@Moab i don't want to change settings on client computers. i want to change something at the router/gateway level.
– JohnKiller
Apr 19 '16 at 9:00