actually, since netclient is on the machine that should be reachable by staff, you don't even have to set an egress for staff, unless you want to reach the machine on the ip 10.1.1.25