Securing the Sitecore client on a single server setup with CDN

Question

On a single server setup for Sitecore which has a CDN in front of it how would you go about securing the Sitecore client.

If there was no CDN I would implement IP security to block access to the relevant folders under Sitecore as per

https://doc.sitecore.com/developers/90/platform-administration-and-architecture/en/restrict-access-to-the-client-261848.html#UUID-ea281fb0-819e-e4e3-12d8-fbc978352287_id__Implement_IP-based_security

However with a CDN the IP address reaching the server will always be the CDN's rather than the end users.

Answer 1

You can setup CDN normal way, but block access to the /sitecore on the CDN level. Then add subdomain like cms.example.com that points to the same server but without CDN. And you can setup ip restrictions for /sitecore

Answer 2

CDN is implemented for CD instances only and not CM. So there is no link between securing CM instance with CDN. With regards to securing CM instances, you can follow this link for more clarity: Sitecore Security Guide