云服务器 Docker Nginx代理 状态502 connect() failed (113: No route to host) while connecting to upstream

起因

最近用腾讯云和华为云服务器（CentOS7.6）的Docker Nginx做代理的时候总是不能访问，远程访问状态是502。用本地curl命令测试是可以访问的，经过一番折腾，原来是防火墙没有开端口；真是汗颜（我记得以前用的阿里云不用开内部防火墙端口啊）。

Nginx error.log如下：

[error] 19#19: *1 connect() failed (111: Connection refused) while connecting to upstream, client: 110.184.64.195, server: 127.0.0.1, request: "GET /web/api/regions/2 HTTP/1.1", upstream: "http://127.0.0.1:8889/web/api/regions/2", host: "xxx..."

[error] 19#19: *7 upstream timed out (110: Connection timed out) while reading response header from upstream, client: 172.17.0.1, server: localhost, request: "GET /web/api/regions/2 HTTP/1.1", upstream: "http://192.168.0.87:8889/web/api/regions/2", host: "xxx..."

[error] 19#19: *9 connect() failed (113: No route to host) while connecting to upstream, client: 110.184.64.195, server: localhost, request: "GET /web/api/regions/2 HTTP/1.1", upstream: "http://192.168.0.87:8889/web/api/regions/2", host: "xxx..."

解决办法

开放防火墙端口

# 开放8889端口
firewall-cmd --zone=public --add-port=8889/tcp --permanent
 # 配置立即生效
firewall-cmd --reload