Internal network between container Docker Compose with outgoing connection
Internal Docker networks mean there is no gateway configured to reach the outside internet, you can only reach other containers from that network. In your scenario, none of your networks should have this definition.

Without setting the internal network flag, containers can reach out of the docker host, potentially to the internet if the host has that access. This is one-way access, containers can access the external network, but that external network cannot access the containers.

To access a container from outside of the Docker host, you need to publish the port on the host mapping into the desired container (or service). Publishing ports with the ports section in the docker-compose.yml file is only needed to provide external access, not access between containers. Applications inside containers need to listen on all interfaces (0.0.0.0) for both publishing ports on the host and for container to container communication. However, you can publish ports on a specific interface on the host, e.g.:

ports:
  - '127.0.0.1:8825:8825'
  - '127.0.0.1:8835:8835'


For container to container communication, it is not necessary to expose or publish the port. All that is needed is a user defined network (which you have) in common between the containers. Then the containers can communicate using Docker's built-in DNS to resolve the service name (e.g. consul and mongo) and the application port inside that container (e.g. consul:8300). To avoid the external network from accessing these containers, do not publish any ports from them.

Side note: from your docker-compose.yml, you should also consider removing container_name, depends_on, and build since they won't work if you try to transition to swarm mode.