How can we get all the IP addresses for a specific city. For example, we have a country, state and city. Suppose we want to allow users of specific city only to access the web application. From where can we get the city wise IP addresses.
For example country USA, state California and city San Deigo. Only allow IP addresses from this city to access the web application.
There are many IP geolocation databases around in the internet. You can download it and make some mechanism on your own to check incoming request against it to decide if you want to allow it. However there are much better solutions with databases always up to date with API you can check for incoming IP. For example: https://db-ip.com/api/
Ok thank you
IMHO this is not possible, very error prone and open for numerous mistakes.
IP address-to-city bind in many cases is not static, but varies upon configuration on the side of ISP that holds given queue of IP addresses. You cannot ever, never rely on a static database or list of such binds.
For example, right now (as of writing this), I am sitting at my home in Katowice (a large city in Poland, Europe), but my IP-rev says that I am in Warsaw (capital city of Poland) about 300 km / 3 hours by car from my actual location. When I was checking this a couple of days ago the very same IP address (my router restarts and changes IP address very rarely) claimed to be in Krakow (another big city in Poland, this time 100 km away from my exact location).
The only option you have is to use some kind of geo IP service. Keeping such service up-to-date is a time and cost consuming process, so most of them are paid services only, I am afraid. At least most reliable ones.
Here you have an example of Polish service (I picked first result on the Google list). On the home page (if you translate it to English) you can see pretty much exactly the same claim as I wrote above (automated translation):
IP address geolocation, i.e. determining the geographical location of a computer or other network device based on the IP address, is not 100% accurate. While in the case of large cities it can be assumed that the indications are usually correct (accuracy of 85-90%), in the case of villages and smaller towns, the accuracy of several dozen kilometers must be assumed. Therefore, a neighboring (usually larger) city may often be indicated.
In the case of mobile Internet (3G, LTE), the actual location of the user is often not provided, but the location of the Internet provider’s headquarters. Then basically only the name of the country is provided correctly.
What is the worst in this case as per me is that even with well known, reliable, paid service, you cannot trust 100% on the results you’re getting. And certainly you shouldn’t use them in any kind of security or mission-critical related solutions.
I usually use geo IP solutions as a purely additional feature for my users. Something like a notification or dialog box. For example: “Hey, it seems that you are from London. Is that correct?” [No, fix location]. Etc.
To summarize:
Ok, then how to restrict certain countries from accessing the application
This is nearly never done at application level (i.e. Yii) and nearly always at hosting / server level (i.e. Apache, nginx etc.). Usually you use .htaccess file for this reason.
After Russian-Ukrainian war has flourished the Internet was literally bloated with a hundreds of solutions on how to restrict access to i.e. blog for all the Russian IP addresses. The number of IP addresses to be added to .htaccess file was counted in thousands.
The similar “flourish” was in 2019 when EU has introduced GDPR directive and non-European services or websites, not willing to implement GDPR wanted to limit access to their sites for the European-based users.
But, again, this is a static list. You are on your own with updating it and you must always accept the fact that this is error prone and won’t work in every scenario.
You can use geo IP database for the same reason (geo IP data returns the all-level geo data, starting with continent, going through city and sometimes with street), but this data is not reliable.
You can try to read user GPS location (out of browser or out of mobile device) and then use geo GPS database to “convert” latitude and longitude to country or city. This is similarly error-prone, but gives you a bit more precision (geographical location is a fixed data; country or city will never change its geographic location). But your user or its device may decide to not provide you with GPS data.
You have many options, but non of them seems reliable enough to be used in security measures or mission-critical solutions.
Ok thank you.