I know the IP address of windows update change every 300 seconds, but is there some kind of range I can use to allow svchost.exe access so windows update works without opening up all addresses to my computer?

your firewall doesn't accept dns instead of ip ??

No. IP only.

Whoa that is weird. What firewall are you using?

KPF

No, I'm pretty sure the Windows Update and Microsoft Update sites change whole class C ranges quite often, so unless you plan on allowing a whole class B range of IP's, I'd say you may be out of luck.

Perhaps someone else with KPF has run across this little issue? Have you googled this yet?

Also, I am pretty sure that the latest 4.x versions support dns names, but I could be wrong. I haven't used a software firewall other than the built-in Windows firewall in quite some time. Sorry I can't be more of service.

Yah, I've googled it... The only suggestion I have found is to allow svchost.exe complete connection to the outside world, which I refuse to do.

After much trial, I've got windows update working now by opening up ports 80 and 443 to svchost.exe on the following IP ranges.

64.4.*.*

64.158.*.*

65.59.*.*

67.72.*.*

207.46.*.*

208.172.*.*

A pretty big hole, but it's working, and safer than allowing all address.