Transparent proxying, not affecting other traffic - proxy

Question

I want configure the system as following:
There are several web app servers, each of which have global IP addresses.
The web app servers make HTTP and HTTPS requests to several (unidentified) external services. The source IP address of packets (thus destination port 80/tcp or 443/tcp) need to be fixed to a global IP address, so actually I need transparent proxy for HTTP/HTTPS, not affecting other traffic.
Other packets should not use the global IP address above, but should use global IP addresses that the server is each assigned.
The web application is very old and it's impossible to modify it to use proxy (CONNECT) protocol.
So I tried to use iptables to DNAT from 80/tcp and 443/tcp to the squid proxy on all web servers, and configured squid as an interception proxy.
However I failed it by redirection loop error.
I investigated what squid is doing by strace and found that it tries to connect to 10.0.0.252:80 after receiving a request, and therefore forwarding loop is detected.
I believe it is because of misconfiguration but I have no idea which should be fixed, or maybe totally I misunderstand what I should do.
(I googled but couldn't find the examples that NAT on each server.)
Hope could someone help solve the problem, or suggest another better way (not limited to using squid proxy)
All servers are on Amazon EC2, so it is a choice to use a vyos for a router...
ip a result on squid proxy
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP group default qlen 1000
link/ether 0a:1c:ba:c3:9c:1d brd ff:ff:ff:ff:ff:ff
inet 10.0.0.211/24 brd 10.0.0.255 scope global eth0
valid_lft forever preferred_lft forever
inet6 fe80::81c:baff:fec3:9c1d/64 scope link
valid_lft forever preferred_lft forever
3: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc pfifo_fast state UP group default qlen 1000
link/ether 0a:a9:2c:5e:eb:d7 brd ff:ff:ff:ff:ff:ff
inet 10.0.0.252/24 brd 10.0.0.255 scope global eth1
valid_lft forever preferred_lft forever
inet6 fe80::8a9:2cff:fe5e:ebd7/64 scope link
valid_lft forever preferred_lft forever
iptables on squid proxy
iptables -t nat -A PREROUTING -s 10.0.0.252 -p tcp --dport 80 -j ACCEPT
iptables -t nat -A PREROUTING -p tcp --dport 80 -j DNAT --to-destination 10.0.0.252:3129
iptables on web servers
iptables -t nat -A OUTPUT -p tcp --dport 80 -j DNAT --to-destination 10.0.0.252:80
cache.log
2016/06/22 06:15:22 kid1| WARNING: Forwarding loop detected for:
GET / HTTP/1.1
User-Agent: squidclient/3.5.19
Accept: */*
Via: 1.0 unknown (squid/3.5.19)
X-Forwarded-For: 10.0.0.211
Cache-Control: max-age=259200
Connection: keep-alive
Host: ifconfig.moe
Full squid.conf
acl localnet src 10.0.0.0/8 # RFC1918 possible internal network
acl localnet src 172.16.0.0/12 # RFC1918 possible internal network
acl localnet src 192.168.0.0/16 # RFC1918 possible internal network
acl localnet src fc00::/7 # RFC 4193 local private network range
acl localnet src fe80::/10 # RFC 4291 link-local (directly plugged) machines
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 443 # https
acl Safe_ports port 1025-65535 # unregistered ports
acl CONNECT method CONNECT
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
# Only allow cachemgr access from localhost
http_access allow localhost manager
http_access deny manager
#http_access deny to_localhost
http_access allow localnet
http_access allow localhost
cache_dir ufs /var/spool/squid 100 16 256
coredump_dir /var/spool/squid
visible_hostname unknown
# Squid normally listens to port 3128
http_port 3128
http_port 3129 intercept
http_port 3130 intercept ssl-bump generate-host-certificates=on dynamic_cert_mem_cache_size=4MB cert=/etc/squid/ssl_cert/myCA.pem
always_direct allow all
ssl_bump none localhost
ssl_bump server-first all
# temporary: just test
sslproxy_cert_error allow all
sslproxy_flags DONT_VERIFY_PEER
http_access deny all

Answer 1

If you DNAT to the proxy, you're changing the destination to the IP of the proxy. In this case, the proxy will lose the information about the original destination.
For http this is ok, since the host header can be used to resolve the target, but for https the proxy would need to rely on SNI in the TLS ClientHello packet to learn the target and connect to it, bootstrap the TLS layer and go from there.