Locking access to /user redirect if logged out
I'm not sure this is necessarily the 'best' way to handle this but you could override the access callback for the user and user/login paths in a custom module and do your whitelist check in there:

function MYMODULE_menu_alter(&amp;$items) {
  $items['user']['access callback'] = 'MYMODULE_access_callback';
  $items['user/login']['access callback'] = 'MYMODULE_access_callback';
}

function MYMODULE_access_callback() {
  global $user;

  if ($user-&gt;uid) {
    // If a logged in user is trying to access the login page, deny access
    if (arg(0) == 'user' &amp;&amp; arg(1) == 'login') {
      return FALSE;
    }

    // Otherwise let the user see their page
    return TRUE;
  }

  // If we've got this far the user is not logged in and the access
  // is based on the whitelist
  $whitelist = get_whitelist_array();
  if (in_array(ip_address(), $whitelist)) {
    return TRUE;
  }

  return FALSE;
}