What port(s) does Windows Update use?

I have recently set up a firewall for egress filtering that blocks all traffic originating in my DMZ unless it is HTTP, HTTPS, or DNS.  I have a web server in there running Windows 2000 Server that I would like to check for patches, but Windwos Update no longer works.  I can get to the web site, but when I click check for updates, I get a failure message.  I suspect, but have not tried it, that I could resolve the issue by unblocking all traffic temporarily.  I would prefer to poke a hole in the firewall for this instead.  Can you tell me the port number(s) and destination servers that I need to create exceptions for in order to make this work?

Thanks in advance!