Istio is using external IP

Node has two network interfaces, internal and external. Kubernetes is set to use an internal network interface for node communication:

apiVersion: kubeadm.k8s.io/v1beta2
kind: InitConfiguration
bootstrapTokens:
localAPIEndpoint:
  advertiseAddress: "10.x.x.x"

After I closed all (except needed) ports on the external interface of the worker node I am getting this on ingressgateway:

stream logs failed Get "https://149.xx.xx.xx:10250/containerLogs/istio-system/istio-ingressgateway-85784bd4b6-lwv56/istio-proxy?follow=true&tailLines=100&timestamps=true": dial tcp 149.xx.xx.xx:10250: i/o timeout for istio-system/istio-ingressgateway-85784bd4b6-lwv56 (istio-proxy)

How to make Istio use internal network IPs for that?

Self-managed Kubernetes 1.23.3, Istio 1.12.3 (using Istio Operator)

Additional info

This could be relevant to this issue. There is NodePort service that exposes Istio Gateway ports:

apiVersion: install.istio.io/v1alpha1
kind: IstioOperator
metadata:
  name: config
  namespace: istio-system
spec:
  profile: default
  components:
    base:
      enabled: true
      
    ingressGateways:
      - name: istio-ingressgateway
        enabled: true
        k8s:
          service:
            type: NodePort
            externalTrafficPolicy: Local
            selector:
              app: istio-ingressgateway          
            ports:
              - name: http
                port: 8000
                targetPort: 8000
                nodePort: 80
              - name: https
                port: 1443
                targetPort: 1443
                nodePort: 443

ingressgateway prints only error provided in my question. Using default DNS configuration. Using Calico to close external network interface ports (not using iptables directly):

apiVersion: projectcalico.org/v3
kind: FelixConfiguration
metadata:
  name: default
spec:
  FailsafeInboundHostPorts: []
  FailsafeOutboundHostPorts: []

---

apiVersion: projectcalico.org/v3
kind: HostEndpoint
metadata:
  name: wn-bond1
  labels:
    role: worker-ext
spec:
  interfaceName: bond1
  node: wn

---

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: inbound-external
spec:
  selector: role == 'worker-ext'
  preDNAT: true
  applyOnForward: true
  order: 0
  ingress:
    - action: Allow
      protocol: TCP
      destination:
        ports: [80, 443]
---

apiVersion: projectcalico.org/v3
kind: GlobalNetworkPolicy
metadata:
  name: allow-outbound-external
spec:
  selector: role == 'worker-ext'
  applyOnForward: true
  order: 0
  egress:
    - action: Allow