IMHO this is not possible, very error prone and open for numerous mistakes.
IP address-to-city bind in many cases is not static, but varies upon configuration on the side of ISP that holds given queue of IP addresses. You cannot ever, never rely on a static database or list of such binds.
For example, right now (as of writing this), I am sitting at my home in Katowice (a large city in Poland, Europe), but my IP-rev says that I am in Warsaw (capital city of Poland) about 300 km / 3 hours by car from my actual location. When I was checking this a couple of days ago the very same IP address (my router restarts and changes IP address very rarely) claimed to be in Krakow (another big city in Poland, this time 100 km away from my exact location).
The only option you have is to use some kind of geo IP service. Keeping such service up-to-date is a time and cost consuming process, so most of them are paid services only, I am afraid. At least most reliable ones.
Here you have an example of Polish service (I picked first result on the Google list). On the home page (if you translate it to English) you can see pretty much exactly the same claim as I wrote above (automated translation):
IP address geolocation, i.e. determining the geographical location of a computer or other network device based on the IP address, is not 100% accurate. While in the case of large cities it can be assumed that the indications are usually correct (accuracy of 85-90%), in the case of villages and smaller towns, the accuracy of several dozen kilometers must be assumed. Therefore, a neighboring (usually larger) city may often be indicated.
In the case of mobile Internet (3G, LTE), the actual location of the user is often not provided, but the location of the Internet provider’s headquarters. Then basically only the name of the country is provided correctly.
What is the worst in this case as per me is that even with well known, reliable, paid service, you cannot trust 100% on the results you’re getting. And certainly you shouldn’t use them in any kind of security or mission-critical related solutions.
I usually use geo IP solutions as a purely additional feature for my users. Something like a notification or dialog box. For example: “Hey, it seems that you are from London. Is that correct?” [No, fix location]. Etc.
- No static list or database.
- Dynamically updated, usually paid service only.
- Even though you can’t rely 100% on the results you obtain.