Ping (icmp) work but not tcp about docker-host HOT 33 CLOSED

$ docker-compose up -d dockerhost
Starting dockerhost_dockerhost_1 ... done
[pasha@2 dockerhost]$ sleep 30
[pasha@2 dockerhost]$ docker-compose up -d
dockerhost_dockerhost_1 is up-to-date
Starting dockerhost_nginx-for-test_1 ... done
Starting dockerhost_test_1           ... done
[pasha@2 dockerhost]$ d logs dockerhost_test_1
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (6) Could not resolve host: dockerhost
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (7) Failed to connect to dockerhost port 8888: Host is unreachable
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0curl: (7) Failed to connect to dockerhost port 8888: Host is unreachable

$ docker info
Containers: 49
 Running: 18
 Paused: 0
 Stopped: 31
Images: 72
Server Version: 18.06.1-ce
Storage Driver: zfs
 Zpool: main-zpool
 Zpool Health: ONLINE
 Parent Dataset: main-zpool/docker.zfs
 Space Used By Parent: 55761072128
 Space Available: 170979868544
 Parent Quota: no
 Compression: lz4
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file logentries splunk syslog
Swarm: inactive
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: 468a545b9edcd5932818eb9de8e72413e616e86e
runc version: 69663f0bd4b60df09991c08812a60108003fa340
init version: fec3683
Security Options:
 seccomp
  Profile: default
Kernel Version: 4.19.7-300.fc29.x86_64
Operating System: Fedora 29 (Twenty Nine)
OSType: linux
Architecture: x86_64
CPUs: 8
Total Memory: 31.15GiB
Name: 2.hubbitus.taskdata
ID: HAKG:KAES:UGRG:IVGW:LR4F:MJGA:25UX:HV77:WXLS:B6OL:OSSE:2MPR
Docker Root Dir: /mnt/docker.zfs
Debug Mode (client): false
Debug Mode (server): false
Username: hubbitus
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false

-P INPUT ACCEPT
-P FORWARD DROP
-P OUTPUT ACCEPT
-N DOCKER
-N DOCKER-ISOLATION
-A FORWARD -j DOCKER-ISOLATION
-A FORWARD -o docker0 -j DOCKER
-A FORWARD -o docker0 -m conntrack --ctstate RELATED,ESTABLISHED -j ACCEPT
-A FORWARD -i docker0 ! -o docker0 -j ACCEPT
-A FORWARD -i docker0 -o docker0 -j ACCEPT
-A DOCKER-ISOLATION -j RETURN

# executed inside docker container shell
telnet $(ip -4 route show default | cut -d' ' -f3) 22

# executed inside docker container shell
telnet $(ip -4 route show default | cut -d' ' -f3) 8888

version: '3.7'

services:
  # On host do: curl http://localhost:8080 and you get result
  nginx-for-test:
    image: nginx
    ports:
      - "8888:80"

  test:
    image: nicolaka/netshoot

CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUS              PORTS                  NAMES
2a38470c1b3c        nginx               "nginx -g 'daemon of…"   5 minutes ago       Up 5 minutes        0.0.0.0:8888->80/tcp   test2_nginx-for-test_1_806f155b6b9b

cat /etc/hosts.allow 
# /etc/hosts.allow: list of hosts that are allowed to access the system.
#                   See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: LOCAL @some_netgroup
#             ALL: .foobar.edu EXCEPT terminalserver.foobar.edu
#
# If you're going to protect the portmapper use the name "rpcbind" for the
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
#

cat /etc/hosts.deny 
# /etc/hosts.deny: list of hosts that are _not_ allowed to access the system.
#                  See the manual pages hosts_access(5) and hosts_options(5).
#
# Example:    ALL: some.host.name, .some.domain
#             ALL EXCEPT in.fingerd: other.host.name, .other.domain
#
# If you're going to protect the portmapper use the name "rpcbind" for the
# daemon name. See rpcbind(8) and rpc.mountd(8) for further information.
#
# The PARANOID wildcard matches any host whose name does not match its
# address.
#
# You may wish to enable this to ensure any programs that don't
# validate looked up hostnames still leave understandable logs. In past
# versions of Debian this has been the default.
# ALL: PARANOID

# cat /etc/hosts.allow
cat: /etc/hosts.allow: No such file or directory
# cat /etc/hosts.deny
cat: /etc/hosts.deny: No such file or directory

$ sudo systemctl status firewalld