Dns or hairpin nat? which to use?

I have a setup as follows, and would like to know what people recommend.
the vyos router is the edge router, managing 2 lan subnets and 4 static public ips.
There is a content filter proxy on the subnet, we’ll say has a one to one nat to public ip
I have users on the second subnet, who want to use this proxy regardless if they are on the lan or not.
The lan is using the default masquerade rule which nats to
Connections to the proxy work fine if not on the lan but as soon as they are on the lan it breaks. The firewall is zone based and local to local traffic going to that device works. It’s only if they use the dns name that this breaks.
So what should i do to fix this?
One thing that occurs to me is add the proxy to the hosts file on the vyos router with it’s local address. Is this the best solution? or is there something i’m missing?