Block all traffic except proxy

[mandrekogmail.com]

So I'm trying to setup a lab to simulate some more advanced clients, who deny all traffic into and out of their network, except via a proxy server (typically a websense).

I have the squid proxy running on my pfsense device, and I created an interface which is now assigning DHCP addresses. I added rules to allow the hosts on the network to connect to the pfsense box on port 3128 (proxy) and 53 (dns) for both TCP and UDP. That way they should be able to resolve DNS addresses, and access HTTP(s) through the proxy. However, when doing nslookups, they often won't resolve. If I manually specify "server 10.0.60.1", they work fine. I can also see that 10.0.60.1 is configured as the host's only DNS server, so I'm not sure why it wouldn't be going through.

Is there a best practice for this type of setup? I figure it's becoming more common in large enterprises, so surely there must be something I'm neglecting.