Where did you use the wildcard certificate, which apps servers? In my opinion the wildcard cert is only needed for Meetings and STProxy as they are the only ones that the web browser directly interfaces with. The SIP PR/SIP Edge Proxy can be a self signed certificate. For example for one deployment in DNS the entry to get to the SIP PR is sippr.external.acme.com and the certificate in WAS has been created with the same CN so there's a match. The mobile client, Sametime client and webplayer do not care that it's a self signed certificate. Anyway, this isn't the cause of your problems.
As you're using TCP that makes it less complicated which is good until you get it working.
Sounds like the problem lies with the configuration in TurnServer.properties which is a pain to get your head around and I do not profess to be an expert with the IP and network config.
What you'd need is to 1) have IBM help you with the config of this file which may take a bit of time as it will likely be L3, 2) trial and error until you get a combination that works, 3) post the details of you IP addresses and the contents of your properties file here or reach out to me on Skype
so I can share some of my config and we can try and work it out.
If you haven't already, check out https://www-10.lotus.com/ldd/stwiki.nsf/dx/TURN_Server_single_node_deployment