WSUS and RRAS woes!

I have a small virtual lab going; 1 DC server, 1 WDS/WSUS server, and 1 server running RRAS setup as a router. all running 2012r2 + a few workstations (1 w10 and 1 w7)

My problem is with WSUS and the RRAS server. I cannot get the RRAS to talk to WSUS! RRAS server is NOT on domain. I have set it to get updates from local WSUS via local group policy. Policy is applying fine. It has two virt. NICs, one for WAN side and one for LAN side. RRAS server can ping IP of of WSUS server no problem. It cannot ping the WSUS intranet site. When I look at the windows update log, there are a bunch of warnings/errors stating it cannot communicate with the WSUS website .

Any ideas?

maybe a certificate issue? Does the WSUS server need a self-hosted cert and maybe the RRAS box can't hit it?

Just spitballing here, it's nothing I've had to troubleshoot before.