Hello Nginx Team,
I finally get the idea about the connection.
It is not a TCP connection, it is a persude connection in HTTP level. The NTLM will keep the authenticated HTTP connections info for subsequent connections, so in this case, it should be a bundle TCP authed connections. And for sure, if it works in this way, every proxy won't work with this evil!!! Since this is not the first time I face difficultis with MS system, I totally do not understand why MS could do sth that compliable with industrial standard?! I should say MS makes more valuable, I damned love it!
cn_nginxer