How could I block all non-US IP addresses from access to my website?

Question

I want to block all non-US users from accessing my website. I'm using nginx on the front end and have a django powered website.

1) How can I determine what are US IP addresses?

2) Should I be blocking them in my webserver or in my application layer?

Answer 1

You need a GEO location provider.

Some are free, some are online checks, some give you a list or a library.
Generally the more accuracy you want the more you pay for it.

There is a limit to how accurately you can do this. Some small countries traffic might be routed through the US or it's name servers hosted in the US. Generally you shouldn't get too many false negatives for US customers.

Answer 2

I've used mod_geoip and found it to be largely but not completely effective. The accuracy of the IP / country database is one issue, as is keeping that database up-to-date. I also found that while it helped mitigate some comment spam and DDOS type queries coming from parts of the world not relevant to the content of our site, it also had some unintended consequences. For instance, there were people who attempted to update their site listings while on vacation overseas who were blocked. http://www.maxmind.com/app/mod_geoip