Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work May 2026
Sometimes the background service responsible for categorization simply hangs.
The Kerio appliance must resolve sessions.gfi.com and licensing.gfi.com.
How to test:
Test HTTPS connectivity:
curl -I https://licensing.gfi.com
By [Your Name/Tech Team]
One of the most powerful features of Kerio Control is its ability to filter web content, blocking malicious sites and restricting categories like gambling, adult content, or social media. However, administrators occasionally encounter a frustrating scenario: the Web Filter status displays "Not Activated" or warns that "Categorization is Disabled."
When this happens, your firewall rules relying on URL categories cease to function, leaving the network vulnerable or unfiltered.
This article explores the root causes of this error and provides a step-by-step guide to getting your web categorization back online.
Once you have performed the steps above, verify the system is working:
Use Kerio’s built-in email alerts:
If your organization relies on category-based filtering for compliance (e.g., CIPA for schools, PCI DSS for retail), having categorization disabled creates a policy gap. For example:
Introduction: The Frustration of a Broken Filter
For network administrators relying on Kerio Control (now part of GFI Software), few error messages are as confusing and disruptive as seeing your web filter refuse to work. You navigate to the Web Filter section of the admin interface, expecting to see traffic being categorized and blocked according to your policies. Instead, you are greeted by a greyed-out dashboard, inactive rule sets, and the dreaded status indicators: The Kerio appliance must resolve sessions
This effectively neuters your firewall’s ability to block social media, malware domains, or adult content. Without categorization, your URL rules become useless. This article provides a deep-dive into why this happens and a step-by-step guide to reactivating the filter.
The error "Kerio Control Web Filter is not activated" typically occurs when the firewall loses communication with its categorization servers (Zvelo), or if the special module license has lapsed. Common Fixes Check Licensing:
The Web Filter is a separate paid module. In the WebAdmin, go to Dashboard > License Details to ensure "Kerio Control Web Filter" is still active.
If it’s a new installation, it behaves as a trial for 30 days before automatically disabling. Verify DNS Servers:
The filter relies on DNS queries to categorization servers. If these queries time out 10 times in a row, the filter will auto-disable for reliability.
Recommendation: Use stable public DNS servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) for your custom DNS forwarding.
Reset Reliability Detection (Advanced):If categorization remains disabled despite a good connection, you can force-reset it via the SSH console: Connect via SSH. Run: cd /opt/kerio/winroute
Run: ./tinydbclient "update SiteFilter set DetectReliability=0" Run: /etc/boxinit.d/60winroute restart
Re-Enable in Settings:Navigate to Content Filter > Applications and Web Categories and ensure "Enable Kerio Control Web Filter" is checked. Why This Happens
Authorization Failures: Using an expired Zvelo token (usually expires after 21 days).
ISP/Network Issues: If the firewall cannot reach v4.url.zvelo.com due to slow internet or ISP blocks, it marks the service as unreliable.
Guest Networks: By default, Web Filtering is often disabled on guest interfaces. Test HTTPS connectivity: curl -I https://licensing
Are you seeing a specific "Invalid Authorization" error in the logs, or is the checkbox just grayed out? Using Kerio Control Web Filter
If you are encountering the error "Kerio Control Web Filter is not activated; categorization is disabled," your firewall has likely triggered a safety mechanism that pauses web filtering when it cannot reliably reach the categorization servers.
This issue is typically caused by unstable DNS connections, expired authentication tokens, or network reliability checks failing multiple times in a row. Use the following guide to troubleshoot and implement workarounds. 1. Immediate Workaround: Disable Reliability Detection
Kerio Control is designed to disable the Web Filter if it fails 10 consecutive DNS checks to reach the update servers within one minute. You can force it to ignore these failures and keep the filter active by using the SSH console. Steps to disable reliability detection:
Enable SSH: Hold the Shift key while navigating to Status > System Health in the admin interface, then click Enable SSH.
Access the Shell: Connect to your Kerio device via SSH (e.g., using PuTTY ). Run these commands:
cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution.
Note: This will restart the Kerio Control service and may cause a brief internet interruption. 2. Resolve "Invalid Authorization" and Token Errors
The Web Filter uses an external service (Zvelo) which requires a valid authorization token. These tokens expire every 21 days. If your DNS settings prevent the token from renewing, categorization will be disabled.
Change DNS Forwarding: Do not use Google DNS (8.8.8.8) for all requests, as it can sometimes cause issues with Zvelo authentication.
Configure Custom Forwarding: Navigate to Configuration > DNS. Check Enable custom DNS forwarding and add a rule for *.zvelo.com to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) instead. 3. Fix Licensing and Activation Issues
The Web Filter requires a specific active license; without it, the module behaves as a trial and will automatically disable after 30 days. categorization is disabled
Check Subscription Status: In the GFI Accounts Portal , verify your license is not expired.
Offline Registration: If the online activation fails due to network issues, download the license file from the Kerio Product Registration page and use the Register Offline option in the Kerio Activation Wizard.
Check Disk Space: A full disk can prevent the license file from saving. Use SSH to check disk space and clear cache files in /var/lib/firebase if necessary. 4. Troubleshooting Miscategorized or Blocked Sites
If the filter is activated but still blocking legitimate sites, you can bypass the categorization engine for specific URLs. Using Kerio Control Web Filter
The error "Kerio Control Web Filter is not activated / categorization is disabled"
typically occurs when the system cannot verify the reliability of its categorization service or if the required license has expired Common Causes & Solutions License Expiry Kerio Control Web Filter is an optional module that requires a special license. If you are in a trial period
, the module is automatically disabled after 30 days, making categorization options unavailable. : Verify your license status on the Kerio Control Dashboard Reliability Detection Failure
: Kerio Control sends automatic DNS check queries to its update servers. If it fails to receive a response 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. Temporary Fix
: The system usually attempts to revert to normal operation after one hour. Manual Fix (via SSH)
: You can disable the reliability check manually by logging into the Kerio Control console and running these commands: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard DNS & Connection Issues
: Categorization is handled by an external service (Zvelo). If your DNS settings (like using Google's DNS) interfere with reaching *.zvelo.com , the filter may fail. Cloudflare (1.1.1.1) as custom DNS forwarding servers GFI Support How to Re-enable the Web Filter
If the license and connection are valid, ensure the setting is actually checked in the UI: Kerio Control Administration interface Navigate to Content Filter Applications and Web Categories Enable Kerio Control Web Filter GFI Support SSH commands to check your current license status or verify Zvelo server connectivity Using Kerio Control Web Filter - KerioControl - GFI