ERR_CONNECTION_TIMED_OUT when calling backend NodeJS server behind VPN

I just created a website in reactJS (create-react-app) with a login possibility. I configured autosigned SSL certificates with letsencrypt, added some DNS entries for HSTS and everything that make my website properly traffic-encrypted. My website is running on port 3001 (front-end) and my nodeJs backend is up on port 3000.

Everything works fine, however when some people try to connect to my website behind some VPN (not all of them), they see the page of my app (front-end) but when they try to login (connection to back-end), they get an ERR_CONNECTION_TIMED_OUT.

I cannot reproduce the bug because I do not have such VPN (with my NordVPN its working ok). So I would like you to help me to discover where this problem stems from.

Here is my nginx config file:

# xxx.fr nginx config file
user xxx;
worker_processes 1;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
events {
        worker_connections 1024;
        use epoll;
}
http {
        upstream frontends {
                server xxx.fr:3001;
        }
        charset utf-8;
        include /etc/nginx/mime.types;
        default_type application/octet-stream;
        access_log /var/log/nginx/access.log;
        keepalive_timeout 65;
        proxy_read_timeout 200;
        sendfile on;
        tcp_nopush on;
        tcp_nodelay on;
        gzip on;
        gzip_min_length 1000;
        gzip_proxied any;
        gzip_types text/html text/css text/xml
                application/x-javascript application/xml
                application/atom+xml text-javascript;
        proxy_next_upstream error;
        #include /etc/nginx/sites-enabled/*;
        server {
                # default_server;
                #listen [::]:80;
                add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains; preload ';
                #add_header Content-Security-Policy "default-src 'self';";
                server_name xxx.fr www.xxx.fr;
                client_max_body_size 50M;
                location ^~ /build/static {
                        root /home/xxx/x/public;
                        index  index.html;
                       if ($query_string) {
                                expires max;
                        }
                }
                location = /favicon.ico {
                       rewrite (.*) /public/favicon.ico;
                }
                location = robots.txt {
                        rewrite (.*) /public/robots.txt;
                }
                location / {
                        proxy_pass_header Server;
                        #add_header Strict-Transport-Security "max-age=31536000; includeSubDomains, preload" always;
                        proxy_set_header Host $http_host;
                        proxy_set_header X-Real-IP $remote_addr;
                        proxy_redirect off;
                        proxy_set_header X-Scheme $scheme;
                        proxy_pass http://frontends;
                        proxy_ssl_name $host;
                        proxy_ssl_server_name on;
                }
                listen 443 ssl; # managed by Certbot
                ssl_certificate /etc/letsencrypt/live/xxx.fr/fullchain.pem; # managed by Certbot
                ssl_certificate_key /etc/letsencrypt/live/xxx.fr/privkey.pem; # managed by Certbot
                include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
                ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
        server {
                if ($host = www.xxx.fr) {
                        return 301 https://$host$request_uri;
                } # managed by Certbot
                if ($host = xxx.fr) {
                        return 301 https://$host$request_uri;
                } # managed by Certbot
                #listen 80;
                server_name xxx.fr www.xxx.fr;
                return 404; # managed by Certbot
        }
}

And in my nodeJS server (back-end), I have the following header set:

app.use(function (req, res, next) {
  res.header("Access-Control-Allow-Origin", "*");
  res.header("Access-Control-Allow-Methods", "*");
  res.header("Access-Control-Allow-Credentials", true);
  // res.header("Access-Control-Allow-Credentials", "true");
  res.header(
    "Access-Control-Allow-Headers",
    "Origin, X-Requested-With, Content-Type, Accept, Authorization"
  );
  next();
});

Can anyone tell me how to fix the ERR_CONNECTION_TIMED_OUT ?

Thank you so much