I have security concerns over a web based application. I want to limit access to the application only to a whitelisted IP addresses. Here are my thoughts on that:
To host the application myself.
The application is only required to be accessible during office hours (8am - 4pm). I'll use an internet router to put it online so that other offices from remote locations can access it. With this architecture, I can only give access a whitelisted IP address.
A challenge I have with this, is the database security and backup. I feel the database will be safer online than on my local server, so I plan to use an online database server, then grant access to only one host (which is the external static IP address of my internet router).
I have not done something like this before. So my question is; what are the consequences of this architecture? Also, I will appreciate more advice and suggestions on how to secure and limit access to this application.