I think it's all outbound--machines behind my firewall (no inbound access without initiating an outbound connection first) can run Win Update just fine.

I am the Doctor, and THIS... is my SPOON!