How to Set Up a Debian APT Repository Proxy on Google Cloud Without Outbound Traffic Costs

I manage a bunch of Debian Linux machines that need periodic updates. However, they are behind restrictive and outdated firewalls that I do not control. These firewalls allow only outbound connections to specific IP addresses, not domain names like deb.debian.org and security.debian.org.

The IP addresses behind deb.debian.org and security.debian.org can change over time. This means that the IPs resolved by DNS today are not guaranteed to be the same tomorrow, potentially causing the firewall to block them and disrupt updates.

To solve this problem, I considered creating a reverse proxy with a static IP under my control. This proxy would forward HTTP APT repository requests to a real Debian APT repository server, such as the ones mentioned above.

The issue is that when setting up a proxy like this on a Google Cloud Compute Engine instance, requests forwarded to http://deb.debian.org and http://security.debian.org are considered outbound traffic, which incurs significant costs. As far as I know, Google has its own internal Debian mirrors for updating its Debian machines without counting the traffic as outbound. Does anyone know their addresses?

You might ask: “Why not set up a Debian mirror?”

The answer is cost and simplicity. There’s no need to provision an entire VM with storage and install Debian mirror software when a simple HTTP reverse proxy is sufficient!