I was using a NAT GW in my test.

Successful registration requires both port 443 and port 80, i.e. there is http and https traffic.

All update servers are configured the same way. The server do send messages back to the client. Given that I see a timeout on the server it appears that there may be an issue with the return route.