I think we have the same setup as Drewgon.  This is what I am working on getting working: 
  
downstream WSUS --> Firewall --> WUS/SUP --> SCCM  (WSUS/SUP attaches to another WSUS server for it's updates) 
  
I am a little confused when configuring the role and say whether is connects to MS for updates or an Upstream server.  When configured for an upstream server I get errors.  Am I actually configuring the WSUS settings on the WSUS server from the SCCM when setting this role? 
  
Thanks