title: ERR_CONNECTION_TIMED_OUT when calling backend NodeJS server behind VPN
body: <p>I just created a website in reactJS (create-react-app) with a login possibility.
  I configured autosigned SSL certificates with letsencrypt, added some DNS entries for HSTS and everything that make my website properly traffic-encrypted. My website is running on port 3001 (front-end) and my nodeJs backend is up on port 3000.</p>
  <p>Everything works fine, however when some people try to connect to my website behind some VPN (not all of them), they see the page of my app (front-end) but when they try to login (connection to back-end), they get an <code>ERR_CONNECTION_TIMED_OUT</code>.</p>
  <p>I cannot reproduce the bug because I do not have such VPN (with my NordVPN its working ok). So I would like you to help me to discover where this problem stems from.</p>
  <p>Here is my nginx config file:</p>
  <pre><code># xxx.fr nginx config file
  user xxx;
  worker_processes 1;
  error_log /var/log/nginx/error.log;
  pid /run/nginx.pid;
  events {
          worker_connections 1024;
          use epoll;
  }
  http {
          upstream frontends {
                  server xxx.fr:3001;
          }
          charset utf-8;
          include /etc/nginx/mime.types;
          default_type application/octet-stream;
          access_log /var/log/nginx/access.log;
          keepalive_timeout 65;
          proxy_read_timeout 200;
          sendfile on;
          tcp_nopush on;
          tcp_nodelay on;
          gzip on;
          gzip_min_length 1000;
          gzip_proxied any;
          gzip_types text/html text/css text/xml
                  application/x-javascript application/xml
                  application/atom+xml text-javascript;
          proxy_next_upstream error;
          #include /etc/nginx/sites-enabled/*;
          server {
                  # default_server;
                  #listen [::]:80;
                  add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload ';
                  #add_header Content-Security-Policy &quot;default-src 'self';&quot;;
                  server_name xxx.fr www.xxx.fr;
                  client_max_body_size 50M;
                  location ^~ /build/static {
                          root /home/xxx/x/public;
                          index  index.html;
                         if ($query_string) {
                                  expires max;
                          }
                  }
                  location = /favicon.ico {
                         rewrite (.*) /public/favicon.ico;
                  }
                  location = robots.txt {
                          rewrite (.*) /public/robots.txt;
                  }
                  location / {
                          proxy_pass_header Server;
                          #add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains, preload&quot; always;
                          proxy_set_header Host $http_host;
                          proxy_set_header X-Real-IP $remote_addr;
                          proxy_redirect off;
                          proxy_set_header X-Scheme $scheme;
                          proxy_pass http://frontends;
                          proxy_ssl_name $host;
                          proxy_ssl_server_name on;
                  }
                  listen 443 ssl; # managed by Certbot
                  ssl_certificate /etc/letsencrypt/live/xxx.fr/fullchain.pem; # managed by Certbot
                  ssl_certificate_key /etc/letsencrypt/live/xxx.fr/privkey.pem; # managed by Certbot
                  include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
                  ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
  }
          server {
                  if ($host = www.xxx.fr) {
                          return 301 https://$host$request_uri;
                  } # managed by Certbot
                  if ($host = xxx.fr) {
                          return 301 https://$host$request_uri;
                  } # managed by Certbot
                  #listen 80;
                  server_name xxx.fr www.xxx.fr;
                  return 404; # managed by Certbot
          }
  }
  </code></pre>
  <p>And in my nodeJS server (back-end), I have the following header set:</p>
  <pre><code>app.use(function (req, res, next) {
    res.header(&quot;Access-Control-Allow-Origin&quot;, &quot;*&quot;);
    res.header(&quot;Access-Control-Allow-Methods&quot;, &quot;*&quot;);
    res.header(&quot;Access-Control-Allow-Credentials&quot;, true);
    // res.header(&quot;Access-Control-Allow-Credentials&quot;, &quot;true&quot;);
    res.header(
      &quot;Access-Control-Allow-Headers&quot;,
      &quot;Origin, X-Requested-With, Content-Type, Accept, Authorization&quot;
    );
    next();
  });
  </code></pre>
  <p>Can anyone tell me how to fix the <code>ERR_CONNECTION_TIMED_OUT</code> ?</p>
  <p>Thank you so much</p>