Usually this is because you have hotlink protection turned on, and have not added your subdomain to the list of allowed hosts. Try adding your subdomain to the list or disabling hotlink protection.