Сделал такое правило. Прокси блокирует.
cache.log
2016/12/27 19:14:20.536 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffe04f5e000
2016/12/27 19:14:20.536 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffe04f5e000
2016/12/27 19:14:20.542 kid1| 28,3| Checklist.cc(70) preCheck: 0x7efc6f55de78 checking slow rules
2016/12/27 19:14:20.542 kid1| 28,5| Acl.cc(138) matches: checking http_access
2016/12/27 19:14:20.542 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2016/12/27 19:14:20.542 kid1| 28,5| Acl.cc(138) matches: checking http_access#1
2016/12/27 19:14:20.542 kid1| 28,5| Acl.cc(138) matches: checking !nt_group
2016/12/27 19:14:20.543 kid1| 28,5| Acl.cc(138) matches: checking nt_group
2016/12/27 19:14:20.543 kid1| 33,2| client_side.cc(737) setAuth: Adding connection-auth to local=1.1.1.3:8080 remote=1.1.1.5:57516 FD 13 flags=1 from new Negotiate handshake request
2016/12/27 19:14:20.543 kid1| 28,3| AclProxyAuth.cc(119) checkForAsync: checking password via authenticator
2016/12/27 19:14:20.543 kid1| 28,4| Acl.cc(70) AuthenticateAcl: returning 2 sending credentials to helper.
2016/12/27 19:14:20.543 kid1| 28,3| Acl.cc(158) matches: checked: nt_group = -1 async
2016/12/27 19:14:20.543 kid1| 28,3| Acl.cc(158) matches: checked: !nt_group = -1 async
2016/12/27 19:14:20.543 kid1| 28,3| Acl.cc(158) matches: checked: http_access#1 = -1 async
2016/12/27 19:14:20.543 kid1| 28,3| Acl.cc(158) matches: checked: http_access = -1 async
2016/12/27 19:14:20.602 kid1| 28,5| InnerNode.cc(94) resumeMatchingAt: checking http_access at 0
2016/12/27 19:14:20.603 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2016/12/27 19:14:20.603 kid1| 28,5| InnerNode.cc(94) resumeMatchingAt: checking http_access#1 at 0
2016/12/27 19:14:20.603 kid1| 28,5| InnerNode.cc(94) resumeMatchingAt: checking !nt_group at 0
2016/12/27 19:14:20.603 kid1| 28,5| Acl.cc(138) matches: checking nt_group
2016/12/27 19:14:20.603 kid1| 28,7| UserData.cc(22) match: user is iv@DOMAIN.LOCAL, case_insensitive is 0
2016/12/27 19:14:20.603 kid1| 28,7| UserData.cc(28) match: aclMatchUser: user REQUIRED and auth-info present.
2016/12/27 19:14:20.603 kid1| 28,4| Acl.cc(344) cacheMatchAcl: ACL::cacheMatchAcl: miss for 'nt_group'. Adding result 1
2016/12/27 19:14:20.603 kid1| 28,3| Acl.cc(158) matches: checked: nt_group = 1
2016/12/27 19:14:20.603 kid1| 28,3| InnerNode.cc(97) resumeMatchingAt: checked: !nt_group = 0
2016/12/27 19:14:20.603 kid1| 28,3| InnerNode.cc(97) resumeMatchingAt: checked: http_access#1 = 0
2016/12/27 19:14:20.603 kid1| 28,5| Checklist.cc(400) bannedAction: Action 'DENIED/0is not banned
2016/12/27 19:14:20.603 kid1| 28,5| Acl.cc(138) matches: checking http_access#2
2016/12/27 19:14:20.603 kid1| 28,5| Acl.cc(138) matches: checking all
2016/12/27 19:14:20.603 kid1| 28,9| Ip.cc(95) aclIpAddrNetworkCompare: aclIpAddrNetworkCompare: compare: 1.1.1.5:57516/[::] ([::]:57516) vs [::]-[::]/[::]
2016/12/27 19:14:20.603 kid1| 28,3| Ip.cc(539) match: aclIpMatchIp: '1.1.1.5:57516' found
2016/12/27 19:14:20.603 kid1| 28,3| Acl.cc(158) matches: checked: all = 1
2016/12/27 19:14:20.603 kid1| 28,3| Acl.cc(158) matches: checked: http_access#2 = 1
2016/12/27 19:14:20.603 kid1| 28,3| InnerNode.cc(97) resumeMatchingAt: checked: http_access = 1
2016/12/27 19:14:20.603 kid1| 28,3| Checklist.cc(63) markFinished: 0x7efc6f55de78 answer DENIED for match
2016/12/27 19:14:20.603 kid1| 28,3| Checklist.cc(163) checkCallback: ACLChecklist::checkCallback: 0x7efc6f55de78 answer=DENIED
2016/12/27 19:14:20.603 kid1| 28,5| Gadgets.cc(83) aclIsProxyAuth: aclIsProxyAuth: called for all
2016/12/27 19:14:20.603 kid1| 28,9| Acl.cc(99) FindByName: ACL::FindByName 'all'
2016/12/27 19:14:20.603 kid1| 28,5| Gadgets.cc(88) aclIsProxyAuth: aclIsProxyAuth: returning 0
2016/12/27 19:14:20.603 kid1| 28,8| Gadgets.cc(51) aclGetDenyInfoPage: got called for all
2016/12/27 19:14:20.603 kid1| 28,8| Gadgets.cc(70) aclGetDenyInfoPage: aclGetDenyInfoPage: no match
2016/12/27 19:14:20.604 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffe04f5e030
2016/12/27 19:14:20.604 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffe04f5e030
2016/12/27 19:14:20.604 kid1| 28,4| FilledChecklist.cc(66) ~ACLFilledChecklist: ACLFilledChecklist destroyed 0x7ffe04f5e030
2016/12/27 19:14:20.604 kid1| 28,4| Checklist.cc(197) ~ACLChecklist: ACLChecklist::~ACLChecklist: destroyed 0x7ffe04f5e030