In order to enable remote staging, you also need to specify the tunnel.servlet.hosts.allowed portal.properties on the live server. You need to add the following line to portal-ext.properties:
Where the 192.168.x.x will be the IP of the staging server. It's important to note that if the server has multiple interfaces, that IP address need to be added here which would show up as a source address for the http(s) requests coming from the staging server. The SERVER_IP can be left there, it's the servers own IP addresses.
This is the article: https://github.com/liferay/liferay-docs/blob/7.1.x/discover/portal/articles/100-web-experience-management/07-staging-content-for-publication/01-enabling-staging/03-configuring-servers-for-remote-live-staging.markdown
You can see the same configuration on this document (step 2):
https://github.com/liferay/liferay-docs/blob/7.1.x/discover/deployment/articles/03-configuring-liferay/05-remote-staging-in-a-cluster/00-configuring-remote-staging-in-clustered-environment-intro.markdown - although it contains some problems, see