problem

If this is for legal purposes (such as, you're providing encryption software, which is illegal in the U.S. to export to foreign countries), this may be averted with a simple login or a web form that forces the user to certify that they are inside the U.S. Otherwise, I would agree that you have to ban IP ranges, which will probably never be 100% certain. Of course, a Finnish user could theoretically dial up a PPP account with an ISP in the U.S. and get a U.S. IP address. Gating or telnetting through Unix shells can also bypass IP checks. This is pretty outlandish to consider, but ... I guess the solution depends on *why* you want to do this.

Weird demand :) I think the best you can do is check the clients IP address, do a DNS lookup on it and parse the string (if it has been registered with a DNS). But it is possible you only have IP address. Then you'll have to log the IP addresses and check later manually using some ip lookup services in the net, and deny some IP address ranges.