...thanks for the pointer to your conclusion. I only partially match your result. It seems I need to VPN to the node running the service with the external-ip itself. If i VPN via the netmaker ingress to a different k3s worker, the service is not curlable or pingable from my external client.