Further tests in lab shows that non-ehternet interfaces are needed in order to offload traffic as expected. An example is when using wireguard interface: in order to offload traffic, it's necessary to add interface wgX to the flowtable.
Otherwise, it won't work as expected

Shouldnt this be adjusted in more files and places?

PR: https://github.com/vyos/vyos-1x/pull/3424

PR: https://github.com/vyos/vyos-1x/pull/3423

https://github.com/vyos/vyos-1x/pull/3422

The current workaround is manual DNAT rules:

set nat destination rule 100 destination port '80'
set nat destination rule 100 protocol 'tcp'
set nat destination rule 100 translation redirect port '3128'

Add any rules before 100 for excluding DNAT and use "bypass"

Few PR checks failing, i will check and fix

Used codeql reusable workflow in a reference repo.
Please review and merge
https://github.com/vyos/vyos-1x/pull/3420

Alternatively I would be willing to look into creating a validator dedicated to Node and TagNode that can be described in the schemas as that is where this task originally started.

PR https://github.com/vyos/vyos-build/pull/598

Min config for old implementation with redirect (1.2):

set service webproxy listen-address 192.168.122.12
set service webproxy url-filtering squidguard block-category 'aggressive'
set service webproxy url-filtering squidguard local-block 'mytest.local'
set service webproxy whitelist destination-address '192.0.2.1'
set service webproxy whitelist destination-address '192.0.2.2'
set service webproxy whitelist source-address '192.0.2.222'
set service webproxy whitelist source-address '192.0.2.223'

Created dedicated task for returning error message via API: https://vyos.dev/T6326

Added reusable workflow for codeql
Please review and approve
https://github.com/vyos/vyos-github-actions/pull/2