CORRECTION: "unless user is at the LAN"
Seems that Cloudmin's embedded VNC application is trying to open a connection directly between the client computer and the Cloudmin server.
This fails if Cloudmin is on a remote datacenter where there is only access to port 10000. It also fails if the user is accessing a LAN installation using port forwarding (either iptables or ssh...).
The web application should be able to manage all the functions, including direct console access, using port 10000 - probably using Ajax + a separate URL for VNC communication)
(please correct me if I am seeing this wrong)