Help needed with STUN issue (coturn)

I have a weird issue with coturn and STUN - TURN is working perfectly. I am using MiroTalk as my video calling app (highly recommended).

If I set coturn to serve both STUN and TURN, every connection runs TURN.

If I change the STUN server for MiroTalk to Google's STUN server, every connection is still via TURN.

If I now disable coturn (so just Google STUN is used), every connection is STUN, and 99% work as they should (some corporate networks barf until I re-enable coturn)

BUT...

If I set MiroTalk to use coturn's STUN but disable its TURN part, no connection is ever made and the call fails (with nothing in the logs other than the coturn service starting). I've tried changing the coturn STUN port to be the same as Google STUN port but it makes no difference

My relevant firewall settings are

firewall.@rule[15]=rule
firewall.@rule[15].name='Allow-STUN-Google'
firewall.@rule[15].dest_port='19302'
firewall.@rule[15].target='ACCEPT'
firewall.@rule[15].src='wan'
firewall.@rule[15].proto='udp'
firewall.@rule[16]=rule
firewall.@rule[16].name='Allow-STUN-TURN-Coturn'
firewall.@rule[16].dest_port='3478-3479'
firewall.@rule[16].target='ACCEPT'
firewall.@rule[16].src='wan'
firewall.@rule[16].proto='tcp' 'udp'
firewall.@rule[17]=rule
firewall.@rule[17].target='ACCEPT'
firewall.@rule[17].src='wan'
firewall.@rule[17].proto='udp'
firewall.@rule[17].dest_port='10000-20000'
firewall.@rule[17].name='Allow-Coturn-Ports'

/etc/turnserver.conf contains

listening-port=3478
#listening-port=19302
#tls-listening-port=5349

# Lower and upper bounds of the UDP relay endpoints:
# (default values are 49152 and 65535)
#
#min-port=49152
#max-port=65535
min-port=10000
max-port=20000

#fingerprint
lt-cred-mech

user=xxx:xxx

server-name=xxx.xxx.xxx
realm=xxx.xxx.xxx
external-ip=xxx.xxx.xxx.xxx

total-quota=100
stale-nonce=600

cert=/etc/acme/xxx.xxx.xxx/fullchain.cer
pkey=/etc/acme/xxx.xxx.xxx/xxx.xxx.xxx.key
cipher-list="ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384"

#no-stdout-log
log-file=/var/log/turnserver.log
verbose

Can anyone spot what I've missed/got wrong, or is there a potential bug in coturns STUN code?

TIA