Normally, when click the Upgrade button in WebFig then the device tries to connect to the upgrade server via the WAN port.
It's not exactly like this. What actually happens is when you click Upgrade button device tries to contact upgrade server and uses usual routing information for that. Whether this means it will use ether1 (WAN port in most of default configs) or some other interface is up to IP configuration.
BTW, WAN interface is more or less only marking on device's case which corresponds to default config. Other than that, all interfaces are equal, all can perform any high-level duty if configured appropriatelly (not exactly peace a cake but not extremely hard either).
I did managed to ping successfully to 22.214.171.124 (via Tools -> Ping) and also did a traceroute to it (via Tools -> Traceroute).
BUT, strangely - when I clicked the button "Check For Updates" in the page "System -> Packages" then the following message appeared:
ERROR: could not resolve dns name
Are you able to understand why this happens?
I fixed it, for some reason there was no DNS server defined in IP->DNS.
I just now added the IP addresses and tried again - and it works.