WebRTC ICE fails to connect when both users set ICE transportpolicy to relay

I am currently working on p2p video calling app and forcing iceTransportPolicy to relay for both the users for testing. I am not able to view streams on the both the users end in this case because the ICE connectivity just fails when both the user's ICE policy are set to relay. But when I am using iceTransportPolicy as relay only for one user(either of them) and other user uses srflx/prflx candidates, the TURN server works just fine and I am able to view streams at both the users end.

I am using a coturn TURN server hosted in AWS with all necessary ports open for it to work successfully. The turn server is also configured properly(according to my understanding) as I can see all kind of candidates are being generated while testing with trickle ICE test page. Here is the test result from trickle ICE.

Can there be an explanation for such a behavior?

As mentioned in the above comment, the TURN createPermission request was failing with error code 403. The reason was a wrong configuration at the turnserver.conf file.

As mentioned in the default turnserver.conf file, for Amazon Ec2 users, it is important to understand the below line.

TURN Server public/private address mapping, if the server is behind NAT.

As my TURN server was indeed hosted in aws ec2, I needed to do a public / private mapping which I was not doing.

My external-ip line in turnserver.conf looked like

external-ip = 1.2.3.4 where as it should be external-ip = 1.2.3.4/172.x.x.x

After making the changes and restarting the turn server, now my service works like a charm.

Keep in mind that this is only needed if your turn server is behind a NAT which is the case with a cloud provider like AWS.

Hope it helps a future reader facing similar issues.