TURN and Trickle ICE not connecting?

Hello,
I wasn’t getting anywhere with nextcloud’s built-in talk (see thread here), so I thought I’d try spinning up eturnal.
I get some results with turn:[machine’s public ip]:port via (Trickle ICE) on firefox librewolf, but I now think the last result means it didn't actually connect. I got the machine's IP with curl -s http://tnx.nl/ip

especially with

$ docker logs eturnal | egrep 'request|authentication|allocation'
egrep: warning: egrep is obsolescent; using grep -E
Cannot query stun.conversations.im:3478: network is unreachable
Cannot query stun.conversations.im:3478: network is unreachable
Cannot query stun.conversations.im:3478: network is unreachable
Cannot query stun.conversations.im:3478: network is unreachable
Cannot query stun.conversations.im:3478: network is unreachable
Cannot query stun.conversations.im:3478: network is unreachable

I also tried with a user/pass by running docker exec eturnal eturnalctl credentials and inputting those into trickle, no dice.

I get a little message on chrome

docker-compose:

networks:
  bridge_network:
    name: bridge_network
    external: true
  backend_network:
    name: backend_network
    external: true
  nextcloud-aio:
    name: nextcloud-aio
    external: true

services:
  #for nextcloud talk to work outside of network
  eturnal:
    image: ghcr.io/processone/eturnal:latest
    networks:
      - backend_network
      - nextcloud-aio
    hostname: eturnal
    container_name: eturnal
    restart: unless-stopped
    user: 9000:9000

    ### security options
    read_only: true
    cap_drop:
      - ALL
    cap_add:
      - NET_BIND_SERVICE
    ### Note: if eturnal binds to privileged ports (<1024) directly, the option "security_opt" below must be commented out.
    security_opt:
      - no-new-privileges:true

    ### networking options
    ports:
      - 3480:3478     # STUN/TURN non-TLS | 3478 already in use by nextcloud backend?
      - 3480:3478/udp # STUN/TURN non-TLS | 3478 already in use by nextcloud backend?
      # - 5349:5349   # STUN/TURN TLS
      # - 49152-65535:49152-65535/udp # TURN relay range
    # network_mode: "host"

    ### Environment variables - information on https://eturnal.net/doc/#Environment_Variables
    # environment:
    #   - ETURNAL_RELAY_IPV4_ADDR="203.0.113.4" ##might need and change to tailscale ip?
    #   - ETURNAL_RELAY_IPV6_ADDR="2001:db8::4"
    #   - STUN_SERVICE="false"
    # env_file:
    #   - eturnal.env

    ### Volume mounts - Note: directories/files must be (at least) readable by the eturnal user (9000:9000)
    volumes:
      - /media/server/server/turn/eturnal.yml:/etc/eturnal.yml:ro # for custom config file
    #   - /path/to/tls-files:/opt/eturnal/tls      # for custom tls files

config:

#https://nextcloud-talk.readthedocs.io/en/latest/eturnal/
eturnal:
  ## Shared secret for deriving temporary TURN credentials (default: $RANDOM):
  secret: "[snip]"     # Shared secret

  ## The server's public IPv4 address (default: autodetected):
  #relay_ipv4_addr: "203.0.113.4"
  ## The server's public IPv6 address (optional):
  #relay_ipv6_addr: "2001:db8::4"

  listen:
    -
      ip: "::"
      port: 3480
      transport: udp
    -
      ip: "::"
      port: 3480
      transport: tcp

Is port forwarding necessary?

Any input is appreciated.

Start with the docker-compose configuration and eturnal.yml, then inspect the reported docker logs output and the port mappings for the STUN/TURN service. Compare the configured listen and relay addresses with the Trickle ICE results and Nextcloud Talk eturnal guidance. Done means the service connects successfully through the tested TURN endpoint without the reported network errors.