I have to put in white-list the URLs used by the Update module. What URLs does it uses?
You're probably looking for:
From the update.module file:
/** * URL to check for updates, if a given project doesn't define its own. */ define('UPDATE_DEFAULT_URL', 'http://updates.drupal.org/release-history');
It's worth noting the "if a given project doesn't define its own." part of that - the vast majority of modules use the standard Drupal URL, but not necessarily all of them. If you have any modules that haven't been installed via Drupal.org, check through their .info file and look for the
project status url key. If any modules define a value for that, you'll also want to whitelist it.