Websites load on the VPN, but apt cannot reach the repository

The VPN connects, the internal wiki loads in the browser, and apt update still hangs on a mirror it cannot reach. Nothing about the tunnel is broken in that picture. The browser and the package manager made two separate proxy decisions, and only one of them was configured.

Which decision failed is the only thing worth establishing first.

Read the error before you touch a setting

Each stage leaves a different message. A name that never resolves is DNS, a connect that never completes is routing or a firewall, an immediate 407 is proxy authentication, a certificate complaint is TLS verification, and a signature warning is repository metadata. Those five failures need five different fixes, and a proxy line pasted over a DNS problem only moves the hang.

Copy the exact line and the repository it names before you change anything. A vague memory of "it timed out" is what turns a ten-minute diagnosis into an afternoon.

APT keeps its own proxy settings

APT reads /etc/apt/apt.conf.d/, the main apt.conf, and any file named by APT_CONFIG. It does not read a desktop proxy profile, a GNOME network setting, or a browser extension. The transport does honour proxy environment variables, which is why a working export https_proxy=... in your shell proves nothing about a timer that runs under a different environment.

Dump what the failing process actually sees: apt-config dump | grep -i proxy.

Run that as the user the failing operation runs as. If root reads a different set of files, or a systemd timer starts with a different environment, the dump will differ, and the difference is your answer. Two proxy values that disagree are worse than one missing value, because the transport follows the most specific match it can find.

Set the proxy where the configuration owner expects it

For an administrator-approved explicit proxy, a small fragment in a new file is enough:

Acquire::http::Proxy "http://proxy.corp.example:3128/";
Acquire::https::Proxy "http://proxy.corp.example:3128/";
Acquire::http::Proxy::archive.example.internal "DIRECT";

The third line is the part most examples leave out. A per-host key overrides the generic value, so an internal mirror reachable over the tunnel can skip the proxy while everything else still goes through it. DIRECT is the documented value for that, not an empty string.

Add the fragment as a new numbered file such as /etc/apt/apt.conf.d/95proxy. Overwriting a distribution file means the next package update silently reverts your change.

Credentials stay out of the URI

The APT transport reference points at apt_auth.conf for authentication, and that is where the username and password belong. Embedding them in the proxy URI puts them in process listings, shell history, and every configuration dump pasted into a ticket. The auth file needs restrictive permissions, because it is a credential store.

Check the scheme as well. An HTTPS repository can still be reached through an HTTP proxy; the transport is a separate choice from the URI scheme of the mirror.

A graphical software centre is a separate front end. If it uses PackageKit or a snap backend, the APT fragment changes nothing for it, so confirm which process made the failed request.

Confirm the path, not just the exit code

With the fragment in place, watch the request instead of trusting a green result. apt-get -o Debug::Acquire::http=true update prints the connection attempt, the proxy it selected and the response code, which separates a wrong proxy from a proxy that refused you.

Then test the case that should not work. Disconnect the VPN and confirm the internal mirror stops answering; if it still downloads, something is routing around the tunnel or a stale cache is serving you. Confirm the allowed path still verifies TLS and still checks repository signatures, because a proxy that inspects traffic is not a reason to disable either. Confirm as well that an unauthenticated client gets a clear denial rather than a silent timeout.

Keep the working fragment and the failing output together in the change record. The next person to hit the same hang will recognise the two-line difference faster than any explanation.