What proxy are you using with NDLP? I am sure that most can recognize that the modified page comes back with a status 200, as opposed to the normal 204. I have written rules for McAfee's MEG that detects the difference and returns the cusom block page. I don't have rules handy at the moment, can get them next week some time. But modifying the page as elisowash notes also works.