No external Traffic Possible.

[Trackhe]

The RKE2 cluster. Managed with rancher on a docker node. also in the internal network

This picture describes my deployment very good i think. The problem is that i got it only running with using flannel and give flannel the interface name for the node to node traffic. Then i needed to adjust the routing on the nodes that got an external/public ip for getting a response on the public interface. without that all traffic goes in but on the internal interface out. I fixed that. Now the Cluster can talk over the internal interface and that works great. And i can ping the node2 or 3 and that works also good.
But what is not working is an http request to node2 or 3 over the public ip.

I installed istio on the cluster and setup a very basic virtual service etc. For the test, when i try to reach the site on the internal lan it works from every node. So rke2 / flannel or istio or something else does the bad route. Because if i tcp dump it, the request goes on the public interface in and the response goes on the internal interface out which would never reach the request computer.

I hope someone can help with this because i struggle already 2 weaks with it, of trying and reading docs, issues etc.