external filter

[gumprechtm]

I have a squid proxy running. My content filter is run by an external source (bess). The external filter allows overrides of the filter. Problem: Once someone overrides the filter for whatever reason, the filter is down for everyone. I realize this is because the external filter only sees the proxy address and nothing else. I made sure that the "FORWARDED-FOR" in the squid.conf file was set to on so that the internal address should be sent as "X-FORWARDED-FOR" in the header. The filter still only sees the proxy. I was told by the filter people that that was what I need in my configuration. But that didn't work. What am I missing? dnat/snat maybe?
My physical setup is;
internal network
|
sonicwall
|
switch --------cisco router-----internet
|
squid proxy

I forward from my sonic wall to the proxy via configuration.
Thanks in advance