Please see my comment but hopefully this will provide you with a answer to get you started in the right direction. First, securing a application in the first place is not easy. Securing an application that is open to the Internet has the same principles, but is more difficult and certainly exposes you more. I would first question whether you need this application open to a outside network. If you do, I would recommend seeking help from someone because it is a big task and you do have persistent data stored in a database.
To explain why your current scheme is insecure, I'll offer a analogy. Restricting access via a Mac address is the same as restricting cars (via their license plate) onto a gated community. Sure, you have some access control, but its pretty easy for me to fake a license plate and slap it on my car to get pass your mac addr filter. The idea is to have multiple layers of defense. In this analogy, my house (inside the gated community) is your application. First, The gated community restricts users based on a more general field (ip address) commonly called a white list. This can be bypassed so the next layer would be your true user access control (aka your house door lock). Each user has a username and password so that anything they do can be traced a linked to them. If they do not have a username and password, they obviously can't get access to your house or application in this analogy. Once they get pass your house door lock, certain users might be restricted and can only access certain rooms in the house with their credentials. You can see how this becomes complicated.
The general idea is to create multiple levels of defense so that a attacker has to work very hard and "win" multiple times before getting access to anything. As always, this depends on how sensitive the application is. The more sensitive the data, the more controls that are placed. Please read about developing a threat model before starting. Best of Luck!