Download only from whitelisted IP
Downloads are refused because this account may only download from a whitelisted IP, and the current request IP is not listed. Product text matches the upload whitelist family.
Why this happens
The user (typically the file owner on owner/stream paths) has UserIpWhitelist rows. Empty list = no restriction. Wrong proxy headers can make every IP look wrong. Distinct from Download not allowed (HTML whitelist title on the landing page) and from geo country blocks.
Diagnose and fix
1. Admin → Users → Whitelisted IPs — add the client’s public IP, or clear the list.
2. Confirm the reverse proxy forwards the real client IP.
3. Owner testing from another network must add that IP too.
4. See also Upload only from whitelisted IP for the upload twin.