Kerio Control Web Filter Is Not Activated Categorization Is Disabled Hot Review

  • Inspect logs in Admin UI → Diagnostics → System Logs for web filter or categorization errors.
  • Check license in Admin UI → Licensing/Updates.

    • The message indicates Kerio Control’s web filtering isn’t functioning because URL categorization is disabled or unreachable, which disables policy-based filtering and reporting. Investigate licensing, connectivity to categorization services, configuration, system time/certificates, software version, and resource usage; then re-enable the feature, restore connectivity, renew licenses, rebuild caches, update software, and verify operation. If unresolved, collect logs and contact vendor support.

    If you want, I can produce a tailored checklist or step-by-step script for your specific Kerio Control version and environment—tell me the appliance OS/version, whether you use cloud categorization, and any recent changes.

    | Cause | Description | |-------|-------------| | Expired or missing license | Kerio Control Web Filter requires a valid license (subscription). If expired, categorization is disabled. | | No internet access from Kerio Control | The filter needs to contact Kerio’s cloud categorization servers. Without WAN/DNS access, it fails. | | Web filter service not running | The kerio.webfilter service may be stopped or crashed. | | Misconfiguration in admin interface | Web filter is manually disabled under Configuration → Web Filter → Status. | | DNS resolution failure | Categorization engine cannot resolve categories.kerio.com or related update servers. | | Proxy / upstream firewall blocking | Outbound HTTPS traffic to Kerio’s licensing/categorization APIs is blocked. | | Corrupted local categorization database | Database files may be corrupt, causing the service to disable itself. | | Time/date sync issue | Incorrect system time can break license validation and SSL handshakes with Kerio’s servers. |

    Web Filter activation requires that Kerio Control can resolve:

    Go to Configuration → Network → DNS.

    Test resolution from the diagnostics shell:

    dig update.gfi.com

    Solution: Fix DNS forwarders or bypass internal DNS for Kerio's update domains.

  • Verify license/subscription

  • Confirm connectivity to update servers

  • Ensure firewall/NAT rules permit outbound HTTPS to the categorization service.

  • Check system time

  • Examine logs for errors

  • Check disk space / resources

  • Restart Web Filter services

  • Force category database update

  • Verify policies and binding

  • Test from client

  • Check for known bugs / version issues

  • Contact vendor support

    • Use the built-in diagnostic tool (or SSH/Command line):

    Kerio Control needs to communicate with the external categorization service to function.

    While categorization is broken, you can still filter by:

    But cloud category-based blocking (e.g., “Block Pornography”) will not work until the error is resolved.

    The error message "Kerio Control Web Filter is not activated, categorization is disabled" typically occurs because the firewall has failed to reach the external categorization servers (zvelo.com) multiple times, causing it to mark the service as unreliable and disable it. Immediate Fixes

    Wait 1 Hour: Kerio Control is designed to automatically attempt to revert to normal operation after one hour of the error occurring.

    DNS Verification: Ensure your firewall can resolve external domains. It is recommended to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for *.zvelo.com URLs to avoid authorization failures. Inspect logs in Admin UI → Diagnostics →

    Check License Status: If your Kerio Control or Web Filter subscription has expired, the web filter will be automatically disabled. You can check this in the Dashboard or License section of the GFI administration interface. Technical Workaround (SSH)

    If the web filter remains disabled after an hour and DNS settings are correct, you can manually reset the reliability detection via SSH: Connect via SSH to your Kerio Control console.

    Execute the following commands to disable the reliability check and restart the service:

    cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

    Note: This forces the filter to stay active even if it has trouble reaching the update servers. Configuration Check

    Navigate to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.

    Verify that you have at least one Content Rule active that requires categorization; the filter often only "activates" when a rule is processing traffic. Using Kerio Control Web Filter - KerioControl - GFI

    “Kerio Control Web Filter is not activated. Categorization is disabled.” Web Filter activation requires that Kerio Control can