Kerio Control Web Filter Is Not Activated Categorization Is Disabled Hot !full! -

Troubleshooting Guide: "Kerio Control Web Filter is not activated. Categorization is disabled"

Step 6: Review Firewall Rules That Apply to the Kerio Control Itself

Kerio Control applies its own rule set to traffic originating from the appliance (e.g., license checks, category updates).

Navigate to Configuration → Network Rules → Traffic Rules.

Add a rule at the top:

• Source: Firewall local host
• Destination: Any
• Service: HTTPS (and optionally HTTP, DNS)
• Action: Allow

Place this rule above any "Deny all" rules.

8. Conclusion

The error “Kerio Control Web Filter is not activated. Categorization is disabled.” typically indicates a licensing, connectivity, or service state issue. Following the diagnostic and resolution steps above will restore category-based web filtering. If unresolved, contact GFI/Kerio support with debug logs and license file details. Troubleshooting Guide: "Kerio Control Web Filter is not

Kerio Control: Web Filter Not Activated & Categorization Disabled

Hotfix or Updates

If the issue persists, check for any hotfixes or updates for Kerio Control. GFI (the company behind Kerio) periodically releases updates and hotfixes that can resolve known issues.

3. Datacenter IP Block (Outdated ACLs)

Older Kerio Control versions hardcoded old IP ranges for the categorization servers. If those blocks were sold or changed, your firewall tries to reach dead IPs. This manifests as a "stuck hot" error where the service cycles between activating and failing. Source: Firewall local host Destination: Any Service: HTTPS

Step 3: Fix the "Hot" State by Resetting the Filter Engine

If the service is stuck in a frantic "hot" retry loop, force a reset:

1. Stop the Web Filter service:
   • In the admin interface: Configuration > Web Filter > Uncheck "Enable Web Filter."
   • Apply the change.
2. Clear the local cache:
   • SSH into the Kerio server (Linux or Windows).
   • Navigate to the data directory (/var/kerio/winroute/extensions/urldb/ or C:\Program Files\Kerio\WinRoute\extensions\urldb\).
   • Delete the contents of the cache folder.
3. Start the service:
   • Re-check "Enable Web Filter."
   • Wait 60 seconds. The "hot" error should change to "Downloading database" and then "Active."

Root Causes

This issue typically occurs due to one of the following: Place this rule above any "Deny all" rules

1. Missing or expired license – The Web Filter module requires a valid subscription.
2. Categorization service not started – The background service that downloads and applies URL categories is stopped.
3. No internet access on the Kerio Control host – The appliance cannot contact Kerio’s cloud categorization servers.
4. DNS resolution failure – The server cannot resolve licensing.kerio.com or categorization.kerio.com.
5. Outdated Web Filter database – The local categorization database is missing or corrupted.