Remote site behind VPN - how to allow core & plugin updates?

Question

I have a WP site that's protected by VPN. Neither the "public" or admin part can be accessed without VPN. As the WP core and plugins grow old they need updating, but keeping track is hard as the WP-setup can't connect to wordpress.org to check for updates, most likely due to the VPN.

For example, when I go to Dashboard -> Updates, this message is shown:

Last checked on 12th May 2017 at 1:58 pm.
You have the latest version of WordPress. If you need to re-install version 4.6.1–en_GB, you can do so [..]

Obviously, this is incorrect, as the most recent version is 4.7.4. It simply can't find a newer version and assumes 4.6.1 is the latest.

Another example is when I want to search for new plugins, then I'm prompted with this message:

An unexpected error occurred. Something may be wrong with WordPress.org or this server’s configuration.

The site is hosted on AWS. I do not know much about its configuration, but if requested I can ask someone who knows more and can possibly make changes :) I have FTP access, but not SSH or terminal.

THE GOAL: To find a way to allow the remote WP installation to communicate with & download updates from wordpress.org

Is it possible?

Answer 1

The question (in various different forms) was asked several times, and the answer is always the same, it is security or convenience, select one*.

If you need just the notification then set a "mirror" site with no actual data in a place outside of the VPN, and check it from time to time (how to keep it in sync? you do have your production code on git, right? ;) ), or install one of those plugins that send an email.

An even better solution is to write a script that will use the wordpress.org API to get the current versions of plugin and notify you when they change. This requires more work than the previous option, but OTOH you do not need to maintain and secure an additional wordpress install just for this.

*OK, you can argue with the IT security guys to let you poke a hole in the security, and explain how important it is for you, but I assume their first instinct will be to refuse as it is not essential to the working of wordpress