Kerio Control Web Filter Is Not Activated Categorization Is Disabled Work [repack] Review

When your Kerio Control Web Filter displays a "not activated" status or states that "categorization is disabled," it usually stems from a connectivity failure between your firewall and the Zvelo categorization servers. 

If a simple restart doesn't fix it, follow these steps to restore functionality:  1. Resolve Connectivity & Reliability Issues 

Kerio Control will disable the Web Filter if it fails to receive a DNS response from update servers 10 times in a row. This is a safety mechanism to prevent network hangs when the filter isn't "reliable." 

Temporary Fix: Restart the Kerio Control appliance to restore immediate internet access.

Permanent Fix (via SSH): To prevent future automatic disabling, you must disable the DetectReliability feature: Access the Kerio Control shell via SSH. Navigate to the directory: cd /opt/kerio/winroute.

Execute this command to disable reliability detection:./tinydbclient "update SiteFilter set DetectReliability=0". Restart the engine: /etc/boxinit.d/60winroute restart.  2. Update DNS Forwarding Servers 

If you are using Google's DNS (8.8.8.8), you might encounter "Invalid Authorization" errors because Zvelo key tokens expire every 21 days and may fail to refresh through these servers. 

Solution: Change your custom DNS forwarding servers for *.zvelo.com to Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222).

Action: Update these settings in Configuration > DNS, then reboot the appliance.  3. Verify License & Activation Status 

The Web Filter requires a specific active license module. If your core license is valid but the filter is "not activated," it may be a module-specific expiration. 

Check Status: Go to the Dashboard in the Kerio Control Administration interface to verify the license expiration date.

Re-enable Manually: Sometimes the filter just needs to be toggled:

Navigate to Content Filter > Applications and Web Categories. Uncheck and re-check Enable Kerio Control Web Filter. Click Apply.  4. Advanced Troubleshooting: HTTPS & Wildcards 

If specific sites still aren't being categorized correctly or are blocked despite being whitelisted: 

Enable HTTPS Decryption: The filter cannot categorize encrypted traffic without HTTPS decryption enabled under Content Filter > HTTPS Filtering.

Wildcard Handling: If you whitelist a domain, ensure you use a trailing wildcard (e.g., *.domain.com/*) to capture all sub-paths.  Using Kerio Control Web Filter

The message "Kerio Control Web Filter is not activated; categorization is disabled"

typically indicates that the firewall has lost connection to the external categorization service (Zvelo) or has a licensing/reliability issue support.keriocontrol.gfi.com Primary Causes and Solutions 1. Connection Reliability Detection

Kerio Control periodically checks its connection to update servers via DNS. If these checks fail 10 times in a row within one minute, it marks the Web Filter as "not reliable" and disables categorization. support.keriocontrol.gfi.com The "Wait" Fix

: Functionality often restores itself after one hour of stable connection. The Command Fix

: If it doesn't restore, you can disable the reliability check via SSH using these GFI Support instructions: SSH into your Kerio Control console. Navigate to: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" Restart the service: /etc/boxinit.d/60winroute restart support.keriocontrol.gfi.com 2. DNS Resolution Issues If Kerio cannot resolve *.zvelo.com or other update URLs, categorization will fail. support.keriocontrol.gfi.com : Set a custom DNS forward for *.zvelo.com to use reliable public servers like Cloudflare 208.67.222.222 ) in the DNS section of the admin interface. support.keriocontrol.gfi.com 3. License and Token Expiration Module License

: The Web Filter requires a specific license. Without it, the module is automatically disabled 30 days after installation. Invalid Authorization

: This often means the Zvelo token (which expires every 21 days) is invalid. Ensure your firewall can reach the Kerio Registration Server to refresh these tokens automatically. GFI Support Verification Steps

To ensure the filter is correctly set up once the activation issue is resolved: Enable the Filter : Navigate to Content Filter Applications and Web Categories and ensure Enable Kerio Control Web Filter is checked. Test a URL

feature in the same tab to see if a website is correctly categorized (e.g., "Social Networks"). Check Rules : Ensure your Content Rules (under Content Filter Content Rules

) are using these categories correctly; if the filter is inactive, these rules will appear greyed out. GFI Support to run those database commands? Using Kerio Control Web Filter

This issue typically occurs when Kerio Control loses connectivity to its categorization servers (Zvelo) or fails internal reliability checks. Quick Fixes

Verify Basic Activation: Ensure the feature is actually toggled on. Go to Content Filter > Applications and Web Categories and verify Enable Kerio Control Web Filter is checked.

Check DNS Forwarding: The Web Filter relies on reaching *.zvelo.com. Configure custom DNS forwarding for this domain to reliable servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) rather than internal or ISP servers that might time out.

Reboot the Appliance: A simple restart can often clear temporary authorization token failures or DNS timeouts. Advanced Troubleshooting (via SSH)

If the Web Filter shows as "not activated" even with a valid license, Kerio may have disabled it due to detected unreliability (e.g., more than 10 failed DNS check queries in one minute). To force-enable the service and bypass reliability checks:

Enable SSH: Hold Shift while clicking Status > System Health in the admin interface and click Enable SSH. Connect via SSH using an app like PuTTY.

Run the following commands to disable reliability detection and restart the service:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard Other Potential Causes

License/Token Expiry: Authorization tokens for categorization expire every 21 days. If they fail to renew due to blocked traffic, categorization will disable.

Guest Network Limitations: Note that the Kerio Control Web Filter is disabled by default for the guest network interface.

Are you seeing any specific error logs (like "Invalid Authorization" or "DNS response timeout") in the Error or Debug logs? Using Kerio Control Web Filter - KerioControl - GFI

This report addresses the issue where the Kerio Control Web Filter is reported as "not activated" or "categorization is disabled," causing internet connectivity issues or a failure to apply content filtering rules. 1. Diagnosis & Root Causes Web Filter Service Failure (Zvelo):

Kerio Control uses Zvelo to categorize websites. If the service fails to get updates, it disables categorization. DNS Resolution Issues: Web Filter needs to reach *.zvelo.com

URLs. If custom DNS servers (like Google 8.8.8.8) are slow, it can trigger a "DNS response timeout". Expired License:

Subscription renewal is necessary for Web Filter to function. Corrupted/Invalid Authorization: Expired Zvelo token (expires every 21 days) or corrupted winroute.cfg support.keriocontrol.gfi.com 2. Immediate Workarounds & Fixes A. Fix DNS and Connectivity Change DNS Servers: Ensure your DNS servers are robust. Cloudflare ( ) or OpenDNS ( 208.67.222.222 ) are recommended for better *.zvelo.com resolution. Restart Kerio Control: A simple reboot often restores functionality. support.keriocontrol.gfi.com B. Fix "Categorization is Disabled" via SSH

If the filter stays disabled, manually reset the reliability detection, which might be wrongly flagging the filter as "not working." Login via SSH:

Connect to the Kerio Control console using a tool like PuTTY. Run Commands: cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

This disables the reliability check that turns off the filter after DNS issues. support.keriocontrol.gfi.com C. Fix "Invalid Authorization" (Expired Token) If logs show DNS response 'FAILURE: Invalid authorization' , update the winroute.cfg to ensure the correct Zvelo server is used: Access Configuration: Access the configuration file winroute.cfg through SSH. Verify URL: DiaServerUrl v4.url.zvelo.com Reboot the machine after verifying. support.keriocontrol.gfi.com 3. Verification & Activation Activate/Re-enable: Content Filter > Applications and Web Categories and verify "Enable Kerio Control Web Filter" is checked. Check Licenses: Verify the Subscription/License validity on the Dashboard. Check Logs: Review the Security log for errors related to categorization. GFI Support 4. Long-Term Solutions Verify Subscription: Contact GFI Sales if the license is expired. Check Disk Space:

A "cannot load new license file" error often results from a full disk. Clear cache files if necessary. Use URL Whitelist: If a site is blocked incorrectly, use the Content Filter > Applications and Web Categories > Add feature to whitelist it directly. support.keriocontrol.gfi.com Using Kerio Control Web Filter When your Kerio Control Web Filter displays a

Leo stared at the blinking green cursor on his terminal, the words "Kerio Control: Web Filter not activated. Categorization is disabled." burning like a warning flare.

He was the sysadmin at a small, progressive high school, "The Horizon Academy." The school board had just approved a "responsible digital citizenship" curriculum, which meant Leo was supposed to disable the old, draconian web filter. Their theory: teach kids to self-regulate, not just block them. Leo’s job was to make the network functional but unfiltered.

But the Kerio Control box was ancient, a cranky little server that had been patched, rebooted, and cursed at for five years. When Leo clicked "Save" on the new, filter-less policy, the system didn't just turn off protection—it threw an error. Specifically:

"Kerio Control: Web Filter not activated. Categorization is disabled."

Leo shrugged. That was the goal, right?

He was wrong.

Monday, 8:15 AM

The first wave was innocent. A freshman in Ms. Albright’s history class searched for "Roman Empire engineering." Without categorization, the filter didn't know if this was "Education" or "Weapons." The system defaulted to a limbo state—it let everything through, but it also forgot how to cache or prioritize.

The student’s query hit the main server, then bounced to an ad network, then to a CDN in Moldova, then back. The round trip took 14 seconds. Ms. Albright’s smartboard froze, displaying a spinning wheel of death over a pixelated image of a Roman aqueduct.

Tuesday, 10:20 AM

Mr. Henderson in the library noticed it next. Students researching "endangered species" were being served ads for exotic leather boots. Without content categorization, the traffic shaper had no idea what was payload and what was noise. The school’s 500 Mbps pipe was suddenly acting like DSL.

"Why is YouTube buffering?" a student whined.

"It's not YouTube," Leo muttered, pulling up Kerio’s raw logs. The logs were a screaming kaleidoscope of IP addresses: 45% legitimate school traffic, 55% botnets, cryptominers, and zombie click-farms that had slipped in because no filter was there to blacklist known malicious domains.

Kerio wasn't just a wall; it was a traffic cop. And the cop had gone home.

Wednesday, 1:00 PM – The Boiling Point

The new AI-powered grading platform, "GradeSwift," went down. Every teacher in the building lost their progress reports. The cause? Without bandwidth categorization, a single student’s background torrent client (which he thought he’d closed) opened 8,000 concurrent connections to a seedbox in Luxembourg. Kerio, confused, treated the torrent packets with the same priority as the principal’s Zoom call with the district superintendent.

The call dropped. The superintendent was mid-sentence.

Then came the other problem. Since categorization was disabled, the "safe search" enforcement was also off. A seventh-grader innocently searching for "swim team" was shown results that would make a sailor blush. The filter wasn't blocking bad things; it also wasn't blocking inappropriate things that looked like innocent things.

The principal, Dr. Evans, stormed into Leo's office. "Leo. A parent just called. Their child searched for 'how to build a birdhouse' and got a pop-up for… well, for things you build with birdseed, but not that kind."

Leo stared at the Kerio dashboard. The message was still there, mocking him:

"Web Filter not activated. Categorization is disabled."

He finally understood. "Disabled" didn't mean "open and free." It meant "chaotic and blind." The filter’s absence hadn't created a utopia of self-regulation; it had created a digital jungle where nothing worked right, everything was slow, and the worst stuff rose to the top because there was nothing to push it down.

The Fix

That night, Leo didn't turn the filter back on. Instead, he wrote a 17-line script. It didn't enable categorization. It did something smarter. He set Kerio to a "Log-Only" mode with a custom rule: If categorization is disabled, then throttle all un-categorized traffic to 1kbps and route it to a local cache that updates every 10 seconds.

It was a hack, a Frankenstein solution. But when he hit "Apply," the terminal blinked once.

Status: Web Filter – Custom Policy. Categorization – Bypassed. Work – Resume.

The spinning wheels stopped. The principal’s Zoom reconnected. The torrent client was reduced to a sad, slow trickle. And the seventh-grader’s search for "swim team" now just showed photos of a local pool's schedule.

Leo leaned back. The Kerio box hummed quietly. It wasn't fixed. It was working—despite being broken. And sometimes, that’s the best a sysadmin can hope for.

He printed the error message from Monday and taped it to his monitor. It became his motto: "Not activated. Disabled. But it works."

Because in the end, a good admin doesn't need the filter. He just needs the feeling of the filter—and a really clever script.

Troubleshooting Kerio Control: Web Filter Not Activated & Categorization Disabled

When the Kerio Control Web Filter displays a "Not Activated" status and categorization is disabled, your network loses its primary defense against malicious and inappropriate web content. This issue typically stems from licensing lapses, DNS resolution failures, or expired communication tokens with the Zvelo categorization service. Primary Causes for Activation Issues

Understanding why the filter is disabled is the first step toward a fix. Common triggers include:

Trial Period Expiration: The Kerio Control Web Filter is an optional module. If not licensed, it functions as a 30-day trial and automatically disables itself afterward.

DNS Reliability Failures: Kerio Control sends automatic DNS check queries to its update servers. If these fail 10 times in a row within one minute, the system deems the filter unreliable and disables categorization.

Expired Authorization Tokens: Kerio uses Zvelo for website categorization. The security tokens for this service expire every 21 days. If they fail to renew—often due to custom DNS settings—the filter will show as "not activated". Step-by-Step Solutions 1. Verify License and Enable the Filter

Before technical troubleshooting, ensure the module is active in the software interface. Log in to the Kerio Control Administration interface.

Navigate to Content Filter > Applications and Web Categories. Ensure Enable Kerio Control Web Filter is checked.

Click Apply. If the options are greyed out, your license for this specific module may have expired or is not included in your current subscription. 2. Resolve "Invalid Authorization" (Zvelo Tokens)

If you see "Invalid authorization" errors in your logs, the issue is likely with the Zvelo token renewal.

Check DNS Forwarders: It is highly recommended to use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers for *.zvelo.com URLs.

Manual Reset via SSH: If the token won't refresh, you may need to reset it using the Kerio Control Console. Connect via SSH. Navigate to /opt/kerio/winroute.

Verify the DiaServerUrl value is set to v4.url.zvelo.com in the winroute.cfg file. 3. Disable Reliability Detection

If your Internet connection is slow or your ISP has unstable DNS, Kerio might disable the filter prematurely. You can disable this "safety" check via SSH: Log in to the console via SSH. Leo stared at the blinking green cursor on

Execute the command: ./tinydbclient "update SiteFilter set DetectReliability=0".

Restart the service using: /etc/boxinit.d/60winroute restart. 4. Check for Proxy Conflicts

Note that Application Awareness (which relies on the Web Filter) does not work if a non-transparent proxy server is enabled in Kerio Control. Ensure your Proxy Settings are configured to be transparent if you require full categorization. Testing Your Fix Once you have applied these changes, verify the status: Go to Content Filter > Applications and Web Categories. Use the Test URL tool.

Enter a known URL (e.g., google.com) and verify that a category is returned instead of an error.

For further detailed instructions, refer to the GFI Kerio Control Support Guide. Using Kerio Control Web Filter - KerioControl - GFI

It looks like you’re encountering an issue where Kerio Control’s web filter is not activated and categorization is disabled, preventing content filtering from working properly.

Here’s a concise troubleshooting guide to resolve this:

Part 5: When Nothing Works – The Nuclear Option

If you have tried DNS fixes, time sync, license reinstall, cache deletion, and service restarts, you may be facing a deeper system corruption.

Last resort: Reinstall Kerio Control preserving the configuration.

1. Backup your configuration (.cfg file) and also note your network interface mapping.
2. Download the latest Kerio Control ISO from GFI.
3. Reinstall the OS but choose "Upgrade (preserve configuration)" if available.
4. If not available, perform a clean install and restore the .cfg file.

Warning: Restoring a corrupted configuration can re-introduce the problem. If categorization was disabled in the backup, it will be disabled after restore. You will need to re-check the "Enable categorization" box (if present) or re-bless the license.

Conclusion

The error "Kerio Control web filter is not activated – categorization is disabled" is almost never a hardware failure. In 99% of cases, it is a licensing, DNS, or system clock issue.

Quick Recap Checklist:

• [ ] License active and includes Web Filter module.
• [ ] System time synced with NTP.
• [ ] DNS resolves licensing.gfi.com.
• [ ] Web Filter service is running (green).
• [ ] Categorization checkbox is enabled (if visible).
• [ ] Local cache cleared and rebuilt.

By following this guide, you should see the Web Filter dashboard return to life, categories populating, and your URL rules enforcing correctly. If the problem persists, contact GFI Support with the log file located at /var/log/kerio/web-filter/error.log – it will contain specific HTTP error codes explaining why the cloud categorization handshake is failing.

Remember: A web filter without categorization is like a guard dog without teeth. Fix it immediately to maintain your network’s security and productivity policy.

The error "Kerio Control Web Filter is not activated" typically occurs when the firewall loses communication with its categorization servers (Zvelo), or if the special module license has lapsed. Common Fixes Check Licensing:

The Web Filter is a separate paid module. In the WebAdmin, go to Dashboard > License Details to ensure "Kerio Control Web Filter" is still active.

If it’s a new installation, it behaves as a trial for 30 days before automatically disabling. Verify DNS Servers:

The filter relies on DNS queries to categorization servers. If these queries time out 10 times in a row, the filter will auto-disable for reliability.

Recommendation: Use stable public DNS servers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) for your custom DNS forwarding.

Reset Reliability Detection (Advanced):If categorization remains disabled despite a good connection, you can force-reset it via the SSH console: Connect via SSH. Run: cd /opt/kerio/winroute

Run: ./tinydbclient "update SiteFilter set DetectReliability=0" Run: /etc/boxinit.d/60winroute restart

Re-Enable in Settings:Navigate to Content Filter > Applications and Web Categories and ensure "Enable Kerio Control Web Filter" is checked. Why This Happens

Authorization Failures: Using an expired Zvelo token (usually expires after 21 days).

ISP/Network Issues: If the firewall cannot reach v4.url.zvelo.com due to slow internet or ISP blocks, it marks the service as unreliable.

Guest Networks: By default, Web Filtering is often disabled on guest interfaces.

Are you seeing a specific "Invalid Authorization" error in the logs, or is the checkbox just grayed out? Using Kerio Control Web Filter

Kerio Control Web Filter Not Activated: A Review of Categorization Disabled Workarounds

Kerio Control is a popular network security and UTM (Unified Threat Management) solution that provides robust protection against various types of threats, including web-based attacks. One of its key features is the Web Filter, which allows administrators to control and restrict access to websites based on their categories. However, what happens when the Web Filter is not activated, and categorization is disabled? In this review, we'll explore the implications of this scenario and discuss potential workarounds.

The Issue: Web Filter Not Activated and Categorization Disabled

When the Kerio Control Web Filter is not activated, and categorization is disabled, it means that the solution is not actively monitoring and blocking web traffic based on predefined categories. This can lead to several issues, including:

1. Unrestricted access to malicious websites: Without an active Web Filter, users may inadvertently access malicious websites that host malware, phishing scams, or other types of threats.
2. Inability to enforce company policies: Organizations may have specific policies regarding internet usage, such as blocking social media or entertainment websites during work hours. With the Web Filter disabled, these policies cannot be enforced.
3. Reduced visibility and control: Administrators will not have visibility into web traffic, making it challenging to detect and respond to potential security threats.

Workarounds and Solutions

While it's essential to activate the Web Filter and enable categorization, there are some workarounds that organizations can implement to mitigate the risks:

1. Activate the Web Filter: The most straightforward solution is to activate the Web Filter and enable categorization. This will ensure that web traffic is monitored and blocked based on predefined categories.
2. Implement a third-party web filtering solution: Organizations can consider implementing a third-party web filtering solution that can integrate with Kerio Control. This will provide an additional layer of protection and control over web traffic.
3. Configure Kerio Control to block specific websites: Administrators can manually configure Kerio Control to block specific websites or URLs that are known to be malicious or non-compliant with company policies.
4. Enable DNS filtering: Kerio Control provides DNS filtering capabilities that can block access to malicious websites at the DNS level.

Conclusion

In conclusion, a Kerio Control Web Filter that is not activated, and categorization is disabled, can leave organizations vulnerable to web-based threats. While there are workarounds and solutions available, it's essential to prioritize the activation of the Web Filter and enable categorization to ensure robust protection and control over web traffic. By doing so, organizations can ensure a safer and more secure online environment for their users.

Rating: 2.5/5

The current state of the Kerio Control Web Filter, when not activated and categorization is disabled, leaves much to be desired. While there are workarounds and solutions available, the lack of an active Web Filter and categorization disabled can put organizations at risk. We recommend activating the Web Filter and enabling categorization to ensure optimal protection and control.

Recommendations

• Activate the Kerio Control Web Filter and enable categorization.
• Implement a third-party web filtering solution for additional protection.
• Configure Kerio Control to block specific websites or URLs.
• Enable DNS filtering to block access to malicious websites.

By following these recommendations, organizations can ensure a more secure and controlled online environment.

This error typically occurs when Kerio Control determines that its connection to the categorization servers (Zvelo) is unreliable, often due to DNS timeouts or expired authorization tokens. When the system fails to reach these servers ten times within a single minute, it automatically disables the Web Filter to prevent it from blocking legitimate traffic by mistake. 🛠️ Immediate Fix: Disable Reliability Detection

If your internet is working but the filter remains disabled, you can manually reset the internal "reliability" check via the SSH console.

Enable SSH: Hold Shift and navigate to Status > System Health in the Kerio admin interface, then click Enable SSH.

Access the Console: Connect to your appliance via an SSH client (like PuTTY). Run Reset Commands:

cd /opt/kerio/winroute ./tinydbclient "update SiteFilter set DetectReliability=0" /etc/boxinit.d/60winroute restart Use code with caution. Copied to clipboard

Note: This forces the filter to stay active even if it can't reach the categorization servers immediately. 🌐 Resolve Underlying DNS & Connection Issues Monday, 8:15 AM The first wave was innocent

The Web Filter relies on specific DNS lookups to function. Misconfigured DNS servers are a leading cause of "Invalid Authorization" errors.

Change DNS Forwarders: Avoid using Google DNS (8.8.8.8) as the primary forwarder for categorization queries. Use Cloudflare (1.1.1.1) or OpenDNS instead.

Create Custom Forwarding: In DNS > Custom DNS Forwarding, add a rule for *.zvelo.com pointing to a reliable public DNS.

Check Licenses: Ensure your license hasn't reached its "download limit" for updates. You can check this in the GFI KISS Portal under your license details. ⚠️ Common Causes

Expired Tokens: Zvelo tokens expire every 21 days; if they can't refresh due to blocked traffic, categorization fails.

ISP Latency: A slow or unstable internet link can cause the "10 failures in 1 minute" threshold to be met.

Firewall Blocks: Ensure that your firewall rules allow outgoing traffic for the categorization service on standard ports. If you'd like to troubleshoot further, let me know: What version of Kerio Control are you currently running?

Are you seeing a specific "Invalid Authorization" error in your logs? Do you have HTTPS decryption enabled?

Web Filter categorization disabled. Serial number: ko-197974

Summary of Steps to Resolve

1. Verify License: Ensure your Web Filter license is active.
2. Enable Feature: Go to Content Filter > Web Filter and ensure the main switch is ON.
3. Restart Appliance: Reboot the Kerio Control firewall to restart the background categorization engine.

If these steps do not resolve the issue, check the System Logs (Logs > System) for specific error messages regarding the "Categorization engine" or "Update failure."

When Kerio Control displays the error "Web Filter is not activated" or "categorization is disabled," it typically indicates a breakdown in communication between your firewall and the zvelo categorization servers or an expired license component. This effectively disables category-based filtering rules, leaving your network exposed. Primary Causes and Solutions

DNS Reliability Check Failures: Kerio Control performs automated DNS checks to verify connectivity to update servers. If these queries fail 10 times consecutively within one minute, the system marks the Web Filter as "unreliable" and disables it.

Fix: You can disable this "Reliability detection" via the SSH console by navigating to /opt/kerio/winroute and executing:./tinydbclient "update SiteFilter set DetectReliability=0".

DNS Forwarding Issues: Using certain DNS providers (like Google's 8.8.8.8) can occasionally cause categorization failures.

Recommendation: Use Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) as custom DNS servers specifically for *.zvelo.com domains.

Expired Authorization Tokens: Categorization relies on a security token that expires every 21 days. If your firewall cannot reach the internal GFI/Kerio servers to refresh this token, categorization will stop working.

Licensing Constraints: The Kerio Control Web Filter is a separate licensed module. If your main license does not include this add-on, or if you are 30 days past installation without a valid key, the feature will be automatically disabled. Immediate Troubleshooting Steps

Check License Status: In the Kerio Control Webadmin Dashboard, verify that the "Kerio Control Web Filter" component shows as active and has not exceeded its download limits.

Verify Configuration: Ensure the filter is explicitly enabled under Content Filter > Applications and Web Categories.

Perform a Test URL: Use the "Test URL" tool in the administration interface to see if the firewall can successfully categorize a site like google.com. If it returns an error, the issue is connectivity-based.

Restart Services: A simple reboot of the Kerio Control appliance or a manual restart of the winroute service via SSH often restores functionality if the issue was a temporary timeout. If you'd like, I can:

Provide the exact SSH commands to check your categorization logs. Help you re-register your license if it shows as expired.

Guide you through setting up DNS forwarding for the zvelo servers.

Web Filter categorization disabled. Serial number: ko-197974

The error "Kerio Control Web Filter is reported to be not activated, and categorization is disabled" usually occurs when the system fails to reach its rating servers or encounters licensing issues. Direct Solutions

Bypass Reliability Detection (SSH Method): If the filter is disabled due to a "DNS response timeout", you can force it to ignore these failures:

Enable SSH by navigating to Status > System Health while holding the Shift key. Access the console and navigate to: cd /opt/kerio/winroute.

Execute the following command to disable reliability checks:./tinydbclient "update SiteFilter set DetectReliability=0". Restart the service: /etc/boxinit.d/60winroute restart.

Fix DNS Resolution: The Web Filter relies on reaching v4.url.zvelo.com.

Change your Custom DNS Forwarders to reliable providers like Cloudflare (1.1.1.1) or OpenDNS (208.67.222.222) instead of Google's DNS.

Ensure your firewall allows outgoing DNS traffic to reach these servers. Check Licensing & Subscription:

The Web Filter requires a special license; without it, the module is automatically disabled after 30 days.

Verify your license status on the Dashboard or under Configuration Assistant.

If you are behind a strict firewall, you may need to Register Offline by downloading the license key file from the GFI portal. Common Root Causes

Invalid Authorization: This often means an expired Zvelo token. Tokens typically expire every 21 days and must be refreshed from Kerio's internal servers.

Network Latency/ISP Issues: If Kerio Control fails to receive a DNS response 10 times in a row within one minute, it marks the Web Filter as "unreliable" and disables it.

Incorrect winroute.cfg settings: Ensure the DiaServerUrl is correctly set to v4.url.zvelo.com in the configuration file.

Web Filter categorization disabled. Serial number: ko-197974

Step-by-Step Troubleshooting and Resolution

Step 1: Verify the License

The Web Filter is a premium feature. If your license does not include it, or if the license has expired, the categorization engine will shut down.

1. Log in to the Kerio Control Administration Console.
2. Navigate to Configuration > Licenses.
3. Look for the Kerio Control Web Filter entry.
   • Does it have a green checkmark?
   • Is the status "Active"?
   • Does the license capacity cover the number of users on your network?

If the license is missing or invalid, you must upload a new license file or contact your vendor.

Step 5: Configure an Upstream Proxy (If Used)

If your network connects to the internet via a corporate proxy, Kerio Control must be told to use it.

Go to Configuration → Advanced → Proxy Settings or Web Filter → Upstream Proxy (version dependent).

Enter:

• Proxy server IP/hostname
• Port (typically 8080 or 3128)
• Authentication credentials if required

Without this, categorization requests will time out.

Final Recommendation

Immediately verify licensing and connectivity to GFI update servers. If the issue persists after following the steps above, collect debug logs (Web Filter → Diagnostics → Create debug log) and contact GFI Support, referencing “Web Filter module inactive – categorization disabled.”

Do not rely on category-based filtering until the status shows Activated and Categorization Enabled in the Web Filter status page.