You are getting switching loops because you have connected the 2950 back to itself in a couple of places.

In order to translate internal addressess to external you need a device that can perform Network Address Translation, I would suspect this would be your proxy-server.

The 2950 switch is not capable of Layer 3 Routing operations, so if you want to route between your three VLAN's you will need some other device to do so.

What I would suspect you want to do is connect one of your D-link switches to the CPE Internet device, then connect the "Outside" interface of your Proxy-Server to the the D-Link , and the "Inside" interface to the 2950 in VLAN2. All devices with Real-IP addresses should be connected to this D-link switch. DO NOT give the switch an internet address.

Connect another port on the 2950 VLAN2 to the remainder of your Office LAN.

If possible, install a third interface in your Proxy-Server, and connect this to the 2950 in VLAN3, and connect all your Private-Network devices to the 2950 in VLAN3.

In this scenario, the Proxy-Server is acting as a firewall, protecting the "Inside" network and the "DMZ" (VLAN3) from the internet on the "Outside". If it cannot provide this finctionality, then you should really get a device that can.

* please rate post if helpful *