When you create network with both --config-from and --internal parameters it will pretend it's internal network while in fact it is not. Even docker network inspect will lie to you.

The reason is the netlabel.Internal will be silently discarded in applyConfigurationTo.
It's not possible to combine --internal and --config-only.