diff --git a/roles/base/templates/iptables/iptables b/roles/base/templates/iptables/iptables
index f163ee9749..bc23f84f20 100644
--- a/roles/base/templates/iptables/iptables
+++ b/roles/base/templates/iptables/iptables
@@ -15,7 +15,7 @@
 -A OUTPUT -m state --state RELATED,ESTABLISHED -j ACCEPT
 
 # if the host is external, block some ips
-{% if datacenter != 'iad2' or ( datacenter == 'iad2' and hostvars[inventory_hostname].external == 'true' ) %}
+{% if datacenter != 'iad2' or ( datacenter == 'iad2' and external == 'true' ) %}
 -A INPUT -p all -m set --match-set blocklist src -j REJECT
 {% endif %}