Does it make sense to have the application block users by IP as well as the firewalls?

Question

I am planning to create a system, but I still have some questions about security. I would like to know if it makes sense to block unauthorized users from accessing the system, through the ip, using a PHP script and also firewall rules by AWS EC2, would this be good practice to prevent unauthorized users from accessing the system?
My biggest fear is to compromise the system

PHP sample code

<?php

class RemoteAddress
{
    /**
     * List of trusted IP addresses
     * 
     * @var array
     */ 
    protected $trustedIPs = array('127.0.0.1', '192.168.0.101', '192.168.0.102', '192.168.0.103');

    /**
     * Returns client IP address
     */
    public function isDefinedIpAddress()
    {
        $ip = $_SERVER['REMOTE_ADDR'];
        if(in_array($ip, $this->trustedIPs)){
            $this->returnPage();
        } else {
            $this->returnErrorPage();
        }
    }

    /**
     * Redirects the user to the success page
     * The user will be able to access the website
     */
    private function returnPage() 
    {
        header('Location: index.php');
        exit();
    }

    /**
     * Redirects the user to the error page
     * The user will not be able to access the website
     */
    private function returnErrorPage() 
    {
        header('Location: 403.html'); //We can display an forbidden message maybe...
        exit();
    }
}

$object = new RemoteAddress();
$object->isDefinedIpAddress();

Answer 1

PHP offers great opportunities to mix configuration data, business layer code, HTML and javascript in the same script. Yet IMHO it is not a good practice, because it tends to make writing and executing tests harder.

Here the list of allowed IP addresses is a configuration data. Having to search such data through the code if you later install the application on a different system with different allowed address is not maintainer friendly.

For the point whether IP addresses control should reside inside or outside the application, it is largely a general design decision. Either you specify that the app will not worry for IP security, and it should be protected with a firewall, or you want the app to have as few external configuration as possible and you keep it inside. The first way better respects the single concern principle, but requires a proficient firewall admin. The second way is probably less versatile, but the application will run anywhere with a minimal external configuration. Different use cases and a different public target.