RKE Ingress Gateway fails to listen on node port

Node info as follow:

NAME                 STATUS   ROLES               AGE   VERSION   INTERNAL-IP      EXTERNAL-IP   OS-IMAGE                KERNEL-VERSION                CONTAINER-RUNTIME
k8s-ops-master-100   Ready    controlplane,etcd   19h   v1.23.7   192.168.25.100   <none>        CentOS Linux 7 (Core)   3.10.0-1160.71.1.el7.x86_64   docker://20.10.17
k8s-ops-worker-105   Ready    worker              19h   v1.23.7   192.168.25.105   <none>        CentOS Linux 7 (Core)   3.10.0-1160.71.1.el7.x86_64   docker://20.10.17

I set EXTERNAL-IP on istio-ingressgateway service:

NAME                                         READY   STATUS    RESTARTS   AGE
pod/istio-egressgateway-8744c6d6f-wp9dt      1/1     Running   0          33m
pod/istio-ingressgateway-5bc8dbcdc5-cjnrq    1/1     Running   0          33m
pod/istiod-69659fd756-pmtv7                  1/1     Running   0          33m
pod/kiali-7f9679958-q7vc2                    1/1     Running   0          33m
pod/rancher-istio-tracing-596d69fdfd-ljr6b   1/1     Running   0          33m

NAME                           TYPE        CLUSTER-IP      EXTERNAL-IP      PORT(S)                                                                      AGE
service/istio-egressgateway    NodePort    10.43.207.70    <none>           80:31483/TCP,443:32021/TCP                                                   33m
service/istio-ingressgateway   NodePort    10.43.121.243   192.168.25.105   15021:31368/TCP,80:31380/TCP,443:31390/TCP,31400:31400/TCP,15443:30849/TCP   33m
service/istiod                 ClusterIP   10.43.212.171   <none>           15010/TCP,15012/TCP,443/TCP,15014/TCP                                        33m
service/jaeger-collector       ClusterIP   10.43.23.32     <none>           14268/TCP,14250/TCP                                                          33m
service/kiali                  ClusterIP   10.43.85.73     <none>           20001/TCP,9090/TCP                                                           33m
service/tracing                ClusterIP   10.43.76.176    <none>           16686/TCP                                                                    33m
service/zipkin                 ClusterIP   10.43.171.205   <none>           9411/TCP                                                                     33m

NAME                                    READY   UP-TO-DATE   AVAILABLE   AGE
deployment.apps/istio-egressgateway     1/1     1            1           33m
deployment.apps/istio-ingressgateway    1/1     1            1           33m
deployment.apps/istiod                  1/1     1            1           33m
deployment.apps/kiali                   1/1     1            1           33m
deployment.apps/rancher-istio-tracing   1/1     1            1           33m

NAME                                               DESIRED   CURRENT   READY   AGE
replicaset.apps/istio-egressgateway-8744c6d6f      1         1         1       33m
replicaset.apps/istio-ingressgateway-5bc8dbcdc5    1         1         1       33m
replicaset.apps/istiod-69659fd756                  1         1         1       33m
replicaset.apps/kiali-7f9679958                    1         1         1       33m
replicaset.apps/rancher-istio-tracing-596d69fdfd   1         1         1       33m

NAME                                                       REFERENCE                         TARGETS   MINPODS   MAXPODS   REPLICAS   AGE
horizontalpodautoscaler.autoscaling/istio-egressgateway    Deployment/istio-egressgateway    4%/80%    1         5         1          33m
horizontalpodautoscaler.autoscaling/istio-ingressgateway   Deployment/istio-ingressgateway   4%/80%    1         5         1          33m
horizontalpodautoscaler.autoscaling/istiod                 Deployment/istiod                 0%/80%    1         5         1          33m

But we find it is not listening on its defined ports:

Has anyone encountered a similar problem?
Thanks for any suggestion.