Background:
When not using the SocketLB, in-cluster access to a remote node's nodeports is not handled by the per-packet LB in from-container. Instead it gets processed at the remote node's from-netdev program (the "N/S path").

This is different from the SocketLB, where Cilium supports wildcard lookups that match the nodeport and match the IP against node identities (either local or remote).

Proposal:
Let's harmonize the behaviour by consistently LBing such in-cluster access to nodeports at the source.