diff --git a/roles/base/templates/iptables/iptables.staging b/roles/base/templates/iptables/iptables.staging
index 2f9acad733..d475d55fc0 100644
--- a/roles/base/templates/iptables/iptables.staging
+++ b/roles/base/templates/iptables/iptables.staging
@@ -68,7 +68,7 @@ COMMIT
 # if there are any proxy-only tcp_ports - allow them
 {% if proxy_tcp_ports is defined %}
 {% for port in proxy_tcp_ports %}
-{% for proxy in (groups['proxies'] + groups['proxies-internal']) %}
+{% for proxy in groups['proxies-stg'] %}
 {% if hostvars[proxy]['vpn'] %}
 -A INPUT -p tcp -m tcp --dport {{ port }} --src {{ hostvars[proxy]['ansible_facts']['ansible_tun0']['ipv4']['address'] }} -j ACCEPT
 {% else %}