Symptoms
In some cases it is possible that some users can sign into their accounts from one network, but not from another network. For example, if a user can sign in from their mobile phone, but not from their home wifi network.
Description
What this can likely mean is that the IP address of the user attempting to log in is being rejected for a certain reason. This can affect a user attempting to log into any interface. Including WHM, cPanel, and also webmail.
Workaround
First, you must obtain the IP address being used when attempting to sign. If you are not certain of the IP that the specific device is using at the moment, you can visit the link here from the device that is failing to log in.
Once you confirmed the IP, you can search the IP against several of the system's log. You would need to access the server via the command line. You can sign into the server using SSH, or you can use the "Terminal" from WHM. The logs I mostly suggest checking are:
- /usr/local/cpanel/logs/login_log (will show authentication failures)
- /usr/local/cpanel/logs/cphulkd.log (will show attempts being stopped by brute force protection)
- /var/log/messages (messages from the firewall mentioned here)
One option is that you can use the following command to search each log for the IP in question. Here are some example commands you can use: (Replace '192.168.0.1' with the IP you are searching for.)
# grep '192.168.0.1' /var/log/messages
# grep '192.168.0.1' /usr/local/cpanel/logs/login_log
# grep '192.168.0.1' /usr/local/cpanel/logs/cphulkd.log
Based on your findings from the commands above, you should be able to confirm if the block is coming from authentication failures, brute force protection, or the server's own firewall. This should help you better confirm where exactly the block is coming from, and why the user is not able to sign in properly.