Though “Disable internal proxy access from Blue to other subnets” is enabled and having had set up a firewall rule such as “Allow all from BLUE device to GREEN device” connections are denied in case of the BLUE device being proxified.
I use non standard target ports on the mobile device, it’s 5000/TCP or 5001/TCP.
Solution was to uncheck “Disable internal proxy access to Green from other subnets” and “Disable internal proxy access from Blue to other subnets”, then add port 5001 to “Allowed SSL ports”.
I misunderstood the definition of “disable internal proxy access” versus “disable proxy”.