I host a Wordpress website for a client, and suddenly a few weeks ago they can no longer access the admin section. They are behind a Barracuda F600 firewall. Outside the firewall, wp-admin loads fine. They can login, view the admin options, etc. Behind the firewall they get the login screen, but as soon as they click login the site just spins. The front-end of the site loads fine behind the firewall, however. And after they give up and go to the front-end, the admin bar appears at the top, so they appear to have authenticated.
I ran tcpdump and it looks to me like the page is being sent from my server. Apache access log shows the page delivered w/ a 200 status and is the same payload size as when I login. I disabled Wordfence and the same issue happens. When I view the source after stopping the page load, the source is just empty. No Apache errors of any kind.
Normally I would say "It's the firewall" but a tech actually disabled all rules on the firewall and just had ANY/ANY incoming rule and the same thing happened. On every other machine outside that network loads wp-admin section fine. And, to top it off, their website is Wordpress and they can access their own admin page fine behind the firewall.