So all services needs to talk to consul DNS to resolve these names, right?

How would you expose for example mqtt to public internet-facing in this case?