If you are a network administrator managing a Kerio Control firewall (formerly WinRoute), you may have encountered a frustrating red banner or log entry stating:
Kerio Control sends automated background check queries to ensure its update servers are reachable. If these queries fail 10 times in a row within a single minute, the firewall marks the Web Filter as unreliable and disables it.
The error typically occurs when the firewall cannot reach the Zvelo categorization servers or when the license token has expired. This is often triggered by DNS failures, where the system marks the filter as "unreliable" after multiple failed connection attempts. Core Troubleshooting Steps 1. Verify DNS and Reachability
The is a powerful, integrated module that relies on a dynamic global database (powered by Zvelo) to automatically evaluate and categorize web content. By blocking malicious, inappropriate, or bandwidth-heavy domains, it acts as a critical line of defense for network security.
Kerio Control includes a cloud-based or locally cached URL categorization database. Unlike simple domain blacklists, the Web Filter evaluates the content category of a requested URL (e.g., facebook.com → "Social Networking"). Firewall rules can then allow or deny traffic based on these categories. If you are a network administrator managing a
This article dives deep into why this error occurs, why it often appears with "hot" status, and the step-by-step recovery process.
Check → Advanced → Date & Time .
/etc/init.d/kerio.webfilter restart
Kerio Control Web Filter (URL filtering, content categorization, web policy rules based on categories) This is often triggered by DNS failures, where
The error "Kerio Control Web Filter is not activated, categorization is disabled hot" is rarely a hardware failure. It is almost always a logical issue—license, DNS, time, or a version-specific bug.
: Verify that your Kerio Control and web filter subscription are active and properly configured. Some features may require an active subscription.
: Ensure that your Kerio Control's web filter database is up to date. An outdated database might lead to incorrect categorization or failure to block/allow sites as intended.
: Software Maintenance allows you to continue using the existing version, but you cannot install updates released after its expiration. The Web Filter module will be disabled once the license (not just SWM) expires. remember: The service wants to work.
/etc/init.d/kerio-filtering start
If the "hot" warning still glares at you from the dashboard, remember: The service wants to work. It is "hot" because it is trying desperately to reconnect. Your job is to remove the roadblock—be it a $50 expired subscription or a wrong DNS entry. Do not ignore this message; an offline web filter is an open door for productivity loss and cyber threats.
Execute the following command to disable the reliability check: ./tinydbclient "update SiteFilter set DetectReliability=0" . Restart the service: /etc/boxinit.d/60winroute restart .
Note: The base firewall license might be active, but the Web Filter requires its own valid software maintenance sub-license. 2. Verify Port 443 and Server Connectivity