Ok, it's actually more complicated than that, but it didn't all fit into the subject.
Here is my setup:
sys-net <-> sys-firewall <-> sys-whonix <-> sys-firewall-anon
sys-firewall-anon runs apt-cacher-ng with is configured to also work with fedora qubes. In qubes.UpdatesProxy all templates are set to update using sys-firewall-anon.
If I connect sys-firewall-anon directly to sys-net, it's not "-anon" anymore but I can update fedora based templates no problem. But if I connect sys-firewall-anon to sys-whonix I get 403 error messages for the fedora mirrors.
Updating debian / apt based qubes works perfectly in both scenarios.
In my understanding it should work in both cases, regardless whether the traffic goes over clearnet or Tor.
Any ideas?
/Sven