Windows 8.1 outbound rule for windows update

Using windows firewall with block outbound connections as default, and adding rules for exceptions.

Just tried Win 8.1 and when adding exception for svchost.exe coupled with wuauserv service it will not
let windows update through like it did in Win 8.0..

It will let Defender through but not WU.

I tried coupling svchost with all services and still no go.

I have to allow svchost.exe without limitations to get WU through windows firewall.
This is of course not what I want to.

Something has changed in Win 8.1, anyone has an answer?

Thanks