Nginx reverse proxy with same config working in 2 situations and not in 1 (Vestacp)

I have few vps machines with private networking. I'm using nginx in all of them to proxy pass pass requests into fourth machine (10.129.xxx.xxx) which is only listens private connections.

I just changed the server_name:s from this config but otherwise they are identical:

upstream panel { server 10.129.xxx.xxx:8000; }
server {
  listen      80;
  server_name *.example.com example.com;
  return 301 https://$host$request_uri;
}

server {
  listen      443;
  server_name *.example.com example.com;

  ssl on;
  ssl_certificate     /etc/private/ssl/server.crt;
  ssl_certificate_key /etc/private/ssl/server.key;
  ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-RC4-SHA:ECDHE-RSA-AES128-SHA:AES128-GCM-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!CAMELLIA;
  ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
  ssl_prefer_server_ciphers on;

  location / {
    proxy_pass  http://panel;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $http_host;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_set_header X-Forwarded-Port $server_port;
    proxy_set_header X-Request-Start $msec;
  }
}

This setting works in 2 machines but third one is only giving 502 with nginx error log:

[error] 31890#0: *27 connect() failed (111: Connection refused) while connecting to upstream, client: 123.456.70.80, server: *.example.com, request: "GET / HTTP/1.1", upstream: "http://10.129.xxx.xx:8000/error/50x.html", host: "example.com"

What nginx rules might cause this? Firewall? Where should I be looking for this error? Server with errors has vestacp-panel and apache installed (port 8080) and other servers don't have.