Accessing StackExchange API behind a firewall - are there IP ranges to whitelist? [migrated]

If possible, you can set up an HTTP / TLS reverse proxy in a DMZ, configure domain (hostname) whitelist on that proxy (e.g. sniproxy or HAProxy) and then resolve api.stackexchange.com onto that proxy. This has the additional benefit that it works for any external service and doesn't require a published IP address range list (and therefore no need to update your firewall rules periodically).

I've been doing this in my organization for some time, though not for security purposes. We use Debian as our routers so managing these requires just Linux knowledge.

I'm just sharing my alternative solution here. Of course an official response is the right answer to this question.