A few points:

• You didn't say you were in an environment where you don't really have a webservice. I'd consider any provider that doesn't let you control access lists to be a very crippled one. Find another. There are hundreds, at all price ranges.

• I haven't tested this yet, but am I on the right track?

  I've already answered a better solution for the remote match in another node in this thread. The real point is that you don't need a regex, so stop using it!

• $remote =~ /([A-Za-z0-9\.]*[A-Za-z0-9]+\.[A-Za-z0-9]+)/;
  [download]

  This is not a good regex to match a hostname. You left out the hyphens, for example. At least you didn't use \w like so many do, incorrectly adding underscore to the mix. You get points for that. {grin}
• You really don't want to send the file yourself. What you need is to just do an internal redirect to a URL that you keep secret, as in:

  my @GOODLIST = qw(10.0.1.5 10.0.2.1);
  use CGI qw(:all); use strict;
  for my $remote_addr (remote_addr()) {
    if (grep $remote_addr, @GOODLIST) {
      print redirect ("/secret/URL/here/foo.thingy");
    } else {
      print header ( status => 404 ),
        start_html( 'error' ),
        "The resource you tried to access is not found",
        end_html;
    }
  }
  [download]

  There. That's your whole program. Short and sweet.
• Of course, you can bypass all this nonsense, and simply give out the secret URL to your friends, and change it from time to time. The URL acts as a password. Be sure you don't link to it anywhere, and the directory that it's in must have indexing turned off, or an index.html to keep people from guessing. I've got a directory like that at http://www.stonehenge.com/pic/ that I use for semi-private publishing, such as when I'm publishing one of my columns for review here.

-- Randal L. Schwartz, Perl hacker
Be sure to read my standard disclaimer if this is a reply.