Can I fool HttpRequest.UserHostAddress (REMOTE_ADDR)?

As an additional measure to ensure the security of the web application, I am considering implementing a white client IP address.

Preferred way: do it on the router. However, this is a serious administrative burden in my scenario.

I would like to do this in software on a web server. Is there a reason this is less secure?