Restrict Access based on country using LTM or ASM

when CLIENT_ACCEPTED {
     Get the country client IP 
    switch [whereis [IP::client_addr] country] {
        US -
        CA -
        MX {
            set allowed 1
        }
        default { set allowed 0 }
    }
}
when HTTP_REQUEST {
    if {$allowed == 0}{
        HTTP::respond 403 content {Blocked!}
    }
}

when CLIENT_ACCEPTED {
     Get the country client IP 
    switch [whereis [IP::client_addr] country] {
        "CN" -
        "RU" {
            set allowed 0
        }
        default { set allowed 1 }
    }
}
when HTTP_REQUEST {
    if {$allowed == 0}{
        HTTP::respond 403 content {Blocked!}
    }
}

when CLIENT_ACCEPTED {
     Get the country client IP 
    switch [whereis [IP::client_addr] country] {
        "CN" -
        "RU" {
             Reset the TCP connection
            reject
        }
    }
}

[root@ve1023:Active] config  b rule myrule list
rule myrule {
   when CLIENT_ACCEPTED {
        switch [whereis [IP::client_addr] country] {
                CN -
                RU { drop }
                default {
                        do something else
                }
        }
}
}

I think iRule take a lots of resources, you should try the ASM geolocation feature before u make up your mind on iRule. The detailed write is here.