Yes, apt automatically creates a cache of .deb files, you can set it up so one machine these to the others on you're network. It even works that if debA has the cache, but debB wants a pacakge that isn't in the cache, bebA will download it, give it to debB and keep a copy incase debC wants it later.
There are guides around the internet, I'll try and fine one for you.
Not too sure if its a good idea to use the firewall to serve the cache.
[edit]
you can use apt-proxy or apt-cacher, and probobly other things I found an apt proxy guide at
http://www.debian-administration.org/articles/338