I think I found a clue. My testing was kind of a mess. I just connected to my ingress node and tried to reach the MetalLB IP from there which didn't work. But it did work from any "real" worker node. So I suppose the ingress needs to be on a k8s-worker node instead of the netmaker node. Will try that..