Kubernetes network policy blocks traffic between nodes on AKS
Looks like you hit a known problem in AKS clusters v1.19+ around "Pod IP SNAT/Masquerade behavior".
How it affects clusters using Calico's plugin for Network Policies was explained there by other users:
Just for information of other users, this issue causes problem for a NetworkPolicy with podSelector configs. Since the policy will be set based on the ipset of the pods in the IPtables by Calico, but the source IP of the packet is set to the node IP and even the packets that are supposed to be allowed will be dropped.
Please read more about this problem in github issue #2031, along with the hard fix (node image upgrade) or workaround (run Daemonset creating SNAT exemption in iptables).