For anyone searching later on, I wanted to give an update on this thread. I finally got the configuration working, and the problem wasn't because of the pfSense box. The problem resulted because the proxy server is dual-homed to two networks that had routes between them. Since the proxy server and the pfsense box had 2 networks in common, things were getting screwed up.
The relevant lines from my config (manually configured) are:
For the load balancer:
<type>gateway</type>
<behaviour>balance</behaviour>
<monitorip>192.168.75.1</monitorip>
<name>Proxy_Server</name>
<desc><port><servers>192.168.75.1|192.168.75.1</servers>
<monitor>For the fw rules:
<rule><type>pass</type>
<interface>lan</interface>
<max-src-nodes><max-src-states><statetimeout><statetype>keep state</statetype>
<os><protocol>tcp</protocol>
<source>
<address>192.168.75.1</address>
<not><destination><any><port>80</port></any></destination>
<descr>Allow HTTP</descr>
<gateway>Proxy_Server</gateway></not></os></statetimeout></max-src-states></max-src-nodes></rule>
In my configuration, I have a NAT router (pfsense) that has a LAN, WAN, and OPT1 interfaces. LAN is set up internally, WAN goes to the Internet, and OPT1 is cross-cabled into the proxy. The proxy server is a Solaris 2.8 Squid 3.0 box configured for transparent connections. It has 3 interfaces, bge0, bge1, and bge2. Bge0 goes to the internet, BGE1 goes to the same network as the LAN on the NAT, and bge2 is cross cabled into the pfsense box. It may sound confusing, but we did it this way so the proxy has it's own public IP, and doesn't have to have traffic flow through the NAT if a client configures their browser to go directly to it (which almost all do).
The proxy server has the following ipnat rule applied:
rdr bge2 0.0.0.0/0 port 80 -> 192.168.75.1 port 3128
What I saw happening was confusing for a while, but I was able to figure it out. When traffic from a client who was using the transparent proxy would go through the pfsense box, it would be routed correctly to the proxy server. The proxy server would see it, and respond back but it would go through the wrong interface (bge1 rather than bge2). This resulted in the client receiving the packets, but from the wrong source. If I created a route to force the traffic back through the pfsense box on the proxy, it would work, but then all traffic from the proxy would go through pfsense, which is unnecessary.
Finally, from reading TONS of online material, I figured out that ipfilter would solve this problem with source based routing. I know have the following line in ipf.conf:
pass out quick on bge1 to bge2:192.168.75.254 from 192.168.75.1 to any
This tells all traffic seen on the bge1 (LAN) interface that came from from the proxy subnet (bge2) to go back the way it came (bge2) to the ip of the OPT1. This means that all traffic originated from the LAN goes back through LAN, and all traffic based from the Proxy-Pfsense highway goes back that way.
I know nobody may need to read about this, but I wanted to put my experience here just in case there was someone else with the same problem later on down the road. It certainly cost me a lot of time.
I appreciate all the work others did to get me to this point.</monitor></port></desc>
