Blocking entire countries by IP address

What are the pitfalls?

[rpking]

A client of mine may have to block users from one country for legal reasons. One method suggested has been to use IP addresses to detect the user's country.

However, I believe that this system will not be perfect. If a significant percentage of users from other countries get blocked then we will not use it.

We are more bothered about regular users getting blocked than some banned ones getting through.

So, does anybody know of any examples where this system can fail, such as an AOL setup maybe, or users very close to country borders?

[Eric_Jarvis]

it depends what is being read as the IP address...for example, what happnes with UK based reseller of US server space?

sounds highly dubious to me

[bird]

If at all, then this is only going to work for very few specific countries, and definitively not for any of the more industrialized ones. I wouldn't count on AOL and the likes to use disparate IP ranges depending on the country where their dialup customers are located (they will do it sometimes, but not always).

If you're talking about a development country located on an island, ideally with a repressive regime that controls internet access, then you probably could get a 100% hit rate without any false positives. Well, assuming their citicens can't figure out how to use anonymous proxies, anyway... ;)

If your client is really serious about the matter, then thers's no way around a registration based solution, where they verify their visitor's country of origin by snail mail or fax.