Cliente Por radius nao acessa proxy

Boa noite.
Recentemente adquiri o sistema MK-Auth, ate ai tudo bem thunder cache funcionando squid, tenho apenas um problema, se eu cadastrar um usuario pelo sistema do mk auth o usuario autentica normalmente porem nao tem acesso ao cache ou seja nao e redirecionado para o proxy.
Ou seja quando o usuario autenteica por RADIUS nao consegue ter acesso aos arquivos do cache.
OBS: se eu cadastrar o usuario em HOTSPOT - USER - ADD, o usuario acessar os arquivos do cache normalmente.

Vou postar meu firewal aqui para voces anilizarem.

/ ip firewall filter
add chain=input in-interface="Link Embratel" protocol=tcp dst-port=3128 \
action=drop comment="BLOQUEIO PROXY EXTERNO" disabled=no

add chain=input src-address=10.1.1.0/24 protocol=tcp dst-port=3128 \
action=accept comment="ACEITAR CONEXOES PROXY CLIENTES 1" disabled=no

add chain=input protocol=tcp dst-port=21 action=drop comment="BLOQUEAR ACESSO \
VIA FTP EXTERNO" disabled=no

/ ip firewall nat
add chain=srcnat out-interface="Link Embratel" action=masquerade comment="NAT LINK EMBRATEL" disabled=no

add chain=srcnat out-interface="Link Embratel" src-address=10.1.1.0/24 action=masquerade comment="MASCARAMENTO DO HOTSPOT" disabled=yes

add chain=dstnat src-address=10.1.1.0/24 protocol=tcp dst-port=80 action=dst-nat to-addresses=172.31.255.2 to-ports=3128 comment="NAT THUNDER CACHE" disabled=no

add chain=dstnat protocol=tcp src-address-list=pgcorte hotspot=from-client,auth action=dst-nat to-addresses=172.31.255.2 to-ports=85 comment="PG CORTE" disabled=no

add chain=dstnat src-address=0.0.0.0/0 protocol=tcp src-port=80 action=dst-nat to-addresses=172.31.255.2 to-ports=89 comment="AVISO MANUNTENO" disabled=no

add chain=dstnat protocol=tcp dst-port=2012 action=dst-nat to-addresses=172.31.255.2 to-ports=80 comment="" disabled=no

add chain=dstnat protocol=tcp dst-port=22 action=dst-nat to-addresses=172.31.255.2 to-ports=22 comment="" disabled=no

/ ip firewall mangle
add chain=postrouting protocol=tcp src-port=3128 tos=48 action=mark-connection new-connection-mark=n-cache passthrough=yes comment="Marca o com e sem TOS - MK AUTH" disabled=no

add chain=postrouting protocol=tcp src-port=3128 tos=!48 action=mark-connection new-connection-mark=s-cache passthrough=yes comment="" disabled=no

add chain=postrouting connection-mark=n-cache action=mark-packet new-packet-mark=Cache-Packet passthrough=no comment="Libera cache full - MK AUTH" disabled=no

add chain=output out-interface=Clientes protocol=udp src-port=64872 action=mark-connection new-connection-mark=hotspot-out passthrough=yes comment="Hotspot - Full Clientes 1" disabled=no

add chain=output out-interface=Clientes protocol=tcp src-port=64872 action=mark-connection new-connection-mark=hotspot-out passthrough=yes comment="" disabled=no

add chain=output out-interface=Clientes protocol=tcp src-port=64873 action=mark-connection new-connection-mark=hotspot-out passthrough=yes comment="" disabled=no

add chain=output out-interface=Clientes protocol=tcp src-port=64874 action=mark-connection new-connection-mark=hotspot-out passthrough=yes comment="" disabled=no

add chain=output out-interface=Clientes protocol=tcp src-port=64875 action=mark-connection new-connection-mark=hotspot-out passthrough=yes comment="" disabled=no

add chain=output connection-mark=hotspot-out action=mark-packet new-packet-mark=hotspot passthrough=no comment="" disabled=no

add chain=output connection-mark=Cache-Connection action=mark-packet new-packet-mark=Cache-Packet passthrough=yes comment="" disabled=no

add chain=prerouting p2p=all-p2p action=mark-connection new-connection-mark=p2p_conn passthrough=yes comment="P2PCONN" disabled=no

add chain=prerouting connection-mark=p2p_conn action=mark-packet new-packet-mark=p2p passthrough=yes comment="P2PPACKET" disabled=no