diff --git a/roles/basessh/templates/sshd_config.j2 b/roles/basessh/templates/sshd_config.j2
index 76556a6f1f..3bb3d5f71e 100644
--- a/roles/basessh/templates/sshd_config.j2
+++ b/roles/basessh/templates/sshd_config.j2
@@ -40,7 +40,7 @@ UsePAM yes
 AllowAgentForwarding no
 X11Forwarding no
 PermitTunnel no
-{% if not ansible_hostname.startswith(('bastion')) %}
+{% if ansible_hostname.startswith(('bastion')) %}
 # This is a bastion host, we need tcp forwarding here.
 AllowTcpForwarding yes
 {% else %}