Ironically, strict firewall rules can sometimes block the services required to run the firewall's own features.
The following endpoints are used (depending on version). Ensure they are reachable on TCP 443:
Use the diagnostic tool: Diagnostics → Ping / Traceroute.
Kerio Control is a robust unified threat management (UTM) appliance that provides firewall, VPN, and web content filtering. One of its most valuable features is the ability to block or allow websites based on dynamic URL categorization (e.g., “Social Networking,” “Adult Content,” “Streaming Media”). Ironically, strict firewall rules can sometimes block the
However, administrators occasionally encounter a frustrating problem. Despite enabling web filtering, the system refuses to filter traffic. The dashboard or logs repeatedly state: “Web filter is not activated – categorization is disabled.”
This article explains why this message appears, the seven most common causes, and step-by-step solutions to restore full web filtering functionality.
Sometimes the local database becomes corrupted. Clearing it forces a fresh download. Use the diagnostic tool: Diagnostics → Ping / Traceroute
Via Web Interface (Kerio Control 9.x+):
Via Command Line (SSH):
/usr/local/kerio/winroute/bin/kwfmgr --flush-cache
/etc/init.d/kerio-winroute restart
If you have tried DNS fixes, time sync, license reinstall, cache deletion, and service restarts, you may be facing a deeper system corruption. Kerio Control is a robust unified threat management
Last resort: Reinstall Kerio Control preserving the configuration.
Warning: Restoring a corrupted configuration can re-introduce the problem. If categorization was disabled in the backup, it will be disabled after restore. You will need to re-check the "Enable categorization" box (if present) or re-bless the license.
This status typically arises from one of the following: