I did not provision the nodes with a private network so my consul cluster was running on the public interfaces... this is bad.
for docker-machine add the --digitalocean-private-networking switch to have private network interfaces on the droplets
Refer To:
https://github.com/docker/machine/blob/master/docs/drivers/digital-ocean.md