How to configure sentry behind firewall

my company has specific rule which public ip address of server are not reachable inside local network,

Sentry 20.8.0.dev0992c6f6

my on-premise sentry on ubuntu 18 has a yyy.yyy.yyy.yyy local IP address, and also reachable from xxx.xxx.xxx.xxx public Ip address from internet (port 9000 on both local and public IP address).

i can work with sentry web interface and there is no problem.
but android SDK cannot sent anything and this error is logged on nginx docker container:

nginx_1                        | 2020/10/10 07:42:55 [error] 6#6: 
	*71 connect() failed (113: No route to host) while connecting to upstream, client: ccc.ccc.ccc.ccc, 
	server: , request: "POST /api/2/envelope/ HTTP/1.1", upstream: "http://172.19.0.25:3000/api/2/envelope/", host: "xxx.xxx.xxx.xxx:9000"

nginx_1                        | ccc.ccc.ccc.ccc - - [10/Oct/2020:07:42:55 +0000] 
	"POST /api/2/envelope/ HTTP/1.1" 502 150 "-" "sentry.java.android/3.0.0"

Public IP: xxx.xxx.xxx.xxx
Local IP: yyy.yyy.yyy.yyy
Client IP: ccc.ccc.ccc.ccc

system.url-prefix: ‘http://xxx.xxx.xxx.xxx:9000

I have tried to forward outgoing traffic of xxx.xxx.xxx.xxx:9000 to yyy.yyy.yyy.yyy:9000 using iptables with no success,

please help