TURN: not granting permission to remote peer

I've set up my own turn server, and I'm using dsh to talk to a jami client to test the ICE negotiation. It detects the option for a reflexive channel, but doesn't manage to set it up. Logs from my turn server:

Feb 19 16:46:38 turn turnserver[2112]: 8: : IPv4. tcp or tls connected to: MY_IP:55267
Feb 19 16:46:38 turn turnserver[2112]: 8: : IPv4. Local relay addr: TURN_IP:64611
Feb 19 16:46:38 turn turnserver[2112]: 8: : session 001000000000000002: new, realm=<>, username=<>, lifetime=600
Feb 19 16:46:38 turn turnserver[2112]: 8: : session 001000000000000002: realm <> user <>: incoming packet ALLOCATE processed, success
Feb 19 16:46:42 turn turnserver[2112]: 12: : IPv4. tcp accepted from: REMOTE_DEVICE_IP:61481
Feb 19 16:46:42 turn turnserver[2112]: 12: : ERROR: tcp_peer_accept_connection: peer has no permission to connect

E: The permission is granted, about 90s later, at which point the timeout for the connection establishment has been hit, from what I can tell.

This also looks weird:

Feb 19 19:04:31 turn turnserver[2112]: 7594: : session 000000000000000049: realm <> user <>: incoming packet CHANNEL_BIND processed, error 403: Channel bind cannot be used with TCP relay