26.07.2017

Adding a rule to the Windows Server 2012 R2 firewall for 1C: Enterprise

In progress various services and software for network protocols, these working elements use specific ports through which data exchange occurs.

The Windows Server 2008/2012 R2 firewall is configured to block network activity by default. To give your client programs work through the appropriate ports with server components, must be added to Windows Firewall rules, which will allow data exchange on the network using specific ports.

Users often encounter situations in which client software cannot find a 1C:Enterprise server running in a server environment managed by Win Server 2012. In this case, errors of the following nature may occur:

error accessing the server over the network;

error when performing operations with information base;

an unsuccessful attempt to establish a connection; the required response was not received from the other computer;

was already torn apart established connection due to an incorrect response from an already connected computer.

These errors indicate that the client software was unable to find the 1C server at the specified address. It often happens that on the server the port required for connection is simply closed. In the case of 1C server, this is port number 1541.

To open this port, you need to log into the server via an RDP connection and run Windows management Firewall. This operation can be performed in two ways. The first option is to go to the “Control Panel”, then to the “System and Security” subsection, where you need to launch the firewall itself.

You can also use the command line to do this by executing the firewall.cpl command in it - to do this, press the Win + R hotkeys, then go to the “Open” section, enter the command name and click confirm.

Once we have accessed the Windows Firewall, in its active window we need to select the section additional parameters, which is located in the left menu. Next, on the left side of the new window that opens, you need to go to the rules section for incoming connections and select “Create a new rule” through the “Actions” menu.

A wizard for creating rules for new incoming connections will open in front of us. On the title page, you need to select the type of rule you want to select, labeled “For ports” and you can proceed further. Now we will indicate the network data transfer protocol (in our case we indicate TCP), as well as the number of the port to open.

On the next tab, we will need to directly specify the action that will be associated with the rule we are creating. We are interested in the “Allow connections” action. Select it and click “Next”. Now mark the required profiles Windows Firewall, to which the action we create should apply. last page The wizard prompts us to enter a name for the new rule, and also add a description for it if desired. Click done and finish working with the wizard.

After creating the rule, you need to try connecting to the 1C server again. When connecting, we will see the same error, but now the message talks about a different port, number 1560.

By analogy with the scheme for adding ports described above, we add another rule in which we indicate the range of ports 1560-1591. These ports are required to support various workflows of the 1C program. Ports included in this range are indicated with a hyphen in the “Protocol and Ports” section.

After the completed manipulations, go to the “Windows Firewall with Advanced Security” snap-in. Here, in the rules section for incoming connections, we can see the rules we created. At the same time, the 1C client should now freely connect to the server environment. If you need to connect to your server through the 1C server administration console, you will need to create a separate rule that opens port 1540.

If you need to add rules to outgoing connections, you can use the same scheme for creating rules for individual protocols and programs.

Setting up Windows Firewall for Win Server 2012 on 1C server + MS SQL

Now a few words about how to configure a firewall for Windows Server 2012 in the specified configuration. This combination is not uncommon for modern offices, but sometimes it is required Extra time to understand the principle Windows operation Firewall relative to the 1C server environment.

Provided that the server accepts connections on standard TCP port 1433, you simply need to allow this port using the creation of firewall rules, the principle of which we discussed above. To check whether work is actually going through this port, you can run the Configuration Manager snap-in SQL Server» in Server 2012 and go to the tab network configuration. Here you need to select the protocols tab for MSSQLSERVER and find the TCP/IP protocol in the left window. Select it and click “Properties”, then look for the “IP addresses” tab and open the “IPAII” branch.

If the SQL port is dynamic, you will need permission to connect to next application%ProgramFiles%\Microsoft SQL Server\MSSQL10_50.MSSQLSERVER\MSSQL\Binn\sqlservr.exe.

As mentioned above, 1C server works with port 1541 and ports in the range 1560-1591. However, it often happens that for unknown reasons this list Open ports still prevent you from connecting to the server. For everything to work 100%, you just need to expand this range by indicating ports from 1540 to 1591.

Background... Our company successfully operates 1C:Enterprise version 8.2, which has about 100 intensively used accounting databases. A separate server with quite impressive characteristics has been allocated for this matter, because... During operation, it turned out that the combination 1C:Enterprise 8.2 + MS SQL 2005 is very demanding on such hardware resources as hard disks, processor, and most importantly - quantity random access memory. The cost of such a server for us exceeded 250 thousand rubles (not counting licenses for both the OS and 1C itself).

It was considered unreasonable to allocate separate hardware for 1C:Enterprise version 8.3, and besides, paying another 100 thousand rubles for the second set of keys for the 1C server is very expensive! An attempt to install 1C:Enterprise version 8.3 directly led to the fact that the cluster with existing databases was lost. This is where the peculiarities of installing and running two server versions of 1C:Enterprise on one computer were revealed.

The installation program for 1C:Enterprise 8.2 and 8.3 configures software to use their standard ports: 1540 (used by the server agent), 1541 (used by the cluster manager), 1560-1591 (range of ports used for workflows). Therefore, if the 1C:Enterprise 8.3 server must work simultaneously with the 1C:Enterprise 8.2 server, then the former must specify ports different from those already used by the running instance of the previous version of the server.

On a computer with already installed server 1C:Enterprise version 8.2 has registered and launched the “1C:Enterprise 8.2 Server Agent” service, which already uses the above standard ports. If you installed a 1C:Enterprise 8.3 server “nearby”, then the launch of its service “1C:Enterprise 8.3 Server Agent” will end abnormally, because it will try to use already “occupied” ports. To avoid this, you must do the following.

(Everything described below is true for Windows Server 2008 R2 Enterprise (and Standart) 64 bit + SP1 and 32-bit server versions of 1C:Enterprise 8.2 and 8.3).

1C:Enterprise 8.2 (version 8.2.19.90) was installed by me as a Windows service with rights to run on behalf of an existing one local user"Administrator".

After installation is complete, the window Server Manager -> Configuration -> Services we see the “1C:Enterprise 8.2 Server Agent” service running:

launched with parameters:

C:\Program Files (x86)\1cv82\8.2.19.90\bin\ragent.exe" -srvc -agent -regport 1541 -port 1540 -range 1560:1591 -d "C:\Program Files (x86)\1cv82\ srvinfo"

I installed 1C:Enterprise 8.3 server (version 8.3.4.437) in a similar way:

However, as we see in the window Server Manager -> Configuration -> Services, the “1C:Enterprise 8.3 Server Agent” service did not start:

Now we need to open the window command line cmd and go to the bin directory of the installed server version of 1C:Enterprise 8.3 and try to delete the registration of the “1C:Enterprise 8.3 Server Agent” service with the command ragent.exe -rmsrvc:

C:\Users\administrator>cd C:\Program Files (x86)\1cv8\8.3.4.437\bin C:\Program Files (x86)\1cv8\8.3.4.437\bin>ragent.exe -rmsrvc Error! ControlService error!

I got the error Error! ControlService error! , which is in principle expected, because the service has not registered properly in the system. But in fact, he should leave. In the window Server Manager -> Configuration -> Services you won't see him again.

Now you need to re-register of this server, but at the same time specify ports different from those already used by the 1C:Enterprise 8.2 agent. In my case the command will look like:

C:\Program Files (x86)\1cv8\8.3.4.437\bin>

• -port 2540— port on which the 1C:Enterprise server agent version 8.3 will run;
• -regport 2541— port through which the 1C:Enterprise server cluster, version 8.3, will be administered;
• -range 2560:2591— range of ports for workflows;
• -in “C:\Program Files (x86)\1cv8\srvinfo”— a directory for storing information about the new 1C:Enterprise server cluster being created, version 8.3;
• -usr .\Administrator— the user on whose behalf the 1C:Enterprise server agent version 8.3 will be launched;
• -pwd********— password for the specified user (enter yours).

After this, you will again see the “1C:Enterprise 8.3 Server Agent” service in the window Server Manager -> Configuration -> Services. All you have to do is run it with the command ragent.exe -start:

C:\Program Files (x86)\1cv8\8.3.4.437\bin>ragent.exe -start

In the window Server Manager -> Configuration -> Services we see the “1C:Enterprise 8.3 Server Agent” service:

launched with parameters:

where the “Executable file” field has the setting:

C:\Program Files (x86)\1cv8\8.3.4.437\bin\ragent.exe" -srvc -agent -regport 2541 -port 2540 -range 2560:2591 -d "C:\Program Files (x86)\1cv8\ srvinfo"

And now the most interesting thing: you will have to perform this operation every time there is a need to update the version of the 1C: Enterprise 8.3 server! Bravo, developers...

Now a little about how to live with this connection. There is no longer a need to run the 1C:Enterprise program itself with the old version (from the folder C:\Program Files (x86)\1cv82\common). When installing 1C:Enterprise version 8.3, the desktop shortcut will automatically be overwritten to launch the program from the folder C:\Program Files (x86)\1cv8\common. If you open an accounting database running on a server version 8.2, it will automatically open in the required version of the thin client.

Templates for creating databases (accounting or ZIK) are placed by default in the directory of the user on whose behalf you launched their installation. If you are doing this as an administrator, you will find them in the path C:\Users\administrator\AppData\Roaming\1C\1cv8\tmplts . If you would like to add new base based established template, thin client version 8.3 will see them all:

Now, if you need to register the database version 8.3, then you will need to indicate in the “1C:Enterprise server cluster” field the computer with the 1C server version 8.3 installed and, separated by a colon, the cluster manager port that you specified when registering the 1C server agent version 8.3. In my case it is 2541:

When adding a new one to the list of accounting databases, located on an enterprise server running 1C:Enterprise version 8.3, you must also indicate the server name, followed by a colon - the port used by the cluster manager:

The need to register the utility for cluster administration with both 1C servers (both versions 8.2 and 8.3) remains after each installation/update.

Now let's move on to administering clusters managed by different versions 1C:Enterprise servers on one computer. Open the folder in Explorer along the path C:\Program Files (x86)\1cv8\common, and create a shortcut on the desktop for the cluster administration console version 8.3 (it’s better to immediately rename the shortcut accordingly, for example 1CV8.3):

In the same way, open the folder in Explorer along the path C:\Program Files (x86)\1cv82\common , and create a shortcut on the desktop for the cluster administration console version 8.2 (it’s better to immediately rename the shortcut, for example to 1CV8.2):

On your desktop you will get the following:

Let’s launch the 1C:Enterprise server cluster administration utility version 8.2 with the shortcut “1CV8.2” (since the server uses default ports, the cluster will be displayed without problems):

When you try to open this cluster from the console intended for administering the 1C:Enterprise server cluster version 8.3 (using the desktop shortcut named “1CV8.3”), you will see the error:

Error connecting to the 1C:Enterprise 8.3 server: The client and server versions differ (8.3.4.437 - 8.2.19.90), client application: Cluster Console

To display the 1C:Enterprise server cluster version 8.3 we need, we need to create a new central 1C:Enterprise 8.3 server in this snap-in:

• in field Name you must specify the name of the computer with the 1C:Enterprise 8.3 server installed;
• in field IP port you must specify the port on which the 1C:Enterprise 8.3 server agent runs, which you designated when setting up the agent launch service;
• in field Description indicate description.

After clicking the “OK” button, you will be able to see your new cluster, which was created after installing the 1C:Enterprise server version 8.3.

Those. administration of clusters of different versions of 1C:Enterprise server installed on one computer is carried out using the appropriate snap-ins.

That's basically it. Good luck!

_________
UPD. As practice has shown, the method described in this article is not suitable for simultaneously running several instances of 1C:Enterprise server version 8.3 on one server. When trying to create a new 1C agent service from a different version of 1C:Enterprise, running on different ports, the operation:

C:\Program Files (x86)\1cv8\8.3.4.437\bin>ragent.exe -instsrvc -port 2540 -regport 2541 -range 2560:2591 -d "C:\Program Files (x86)\1cv8\srvinfo" - usr .\Administrator -pwd ********

ends up removing an already running service old version 1C 8.3, but a new one is not created.

In I described a method for installing, creating the appropriate ones and running several versions of 1C:Enterprise 8.3 server on one server...

The article is devoted to launching the 1C:Enterprise platforms versions 8.1 and 8.2 on one working server. This may be necessary in conditions where, say, a partial transition to 8.2 has already been made, but the enterprise still uses configurations for 8.1.

And so, we have a working server SERVER-1C With installed Windows Server 2008 R2 and Windows SQL Server 2008 x64.

Let's perform the platform installation procedure one by one.

Let's start with 1C:Enterprise 8.1. We will not describe the process itself, because... there is nothing supernatural about this. After installation, go to and launch the console Services. Let's go to the service properties Server Agent 1C:Enterprise 8.1 (1C:Enterprise 8.1 Server Agent) and make sure that it is launched from a User with administrator rights or a system account.

Let's start this service. Let's connect the trial database FirmaBuh81:

And connect to it from the workstation:

After the test connection has been successfully completed, we will proceed to installing 1C:Enterprise 8.2. After this, in the same way as we did above, we will go to Start - Control Panel - Administration and launch the console Services. The service will appear Server Agent 1C:Enterprise 8.2 (1C:Enterprise 8.2 Server Agent). Similar to version 8.1, we will set the login parameters for this service:

There is one important thing to note here. According to the 1C standard: The enterprise is launched on 1541 port In order to launch several 1C:Enterprise 8.X Server Agent services at once, we will need to change the port to which the service is bound. Next we will change the ports for version 8.2.

Launch the registry editor ( Start-Run enter regedit and click OK). We follow the path:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\

And we see two folders with the names of our 1C:Enterprise Server Agent services (1C:Enterprise 8.X Server Agent)

We need to change the value of the ImagePath string parameter from

"C:\Program Files\1cv82\8.2.13.219\bin\ragent.exe" -srvc -agent -regport 1541 -port 1540 -range 1560:1591 -d "C:\Program Files\1cv82\srvinfo"

"C:\Program Files\1cv82\8.2.13.219\bin\ragent.exe" -srvc -agent -regport 1641 -port 1640 -range 1660:1691 -d "C:\Program Files\1cv82\srvinfo"

After these steps, we can safely start the 1C:Enterprise 8.2 Server Agent service in Services.

The steps are similar). We will add the rule using the example of the 1C:Enterprise 8.x server (you need to open the port 1541 for cluster manager, ports 1560-1591 for workflows and port 1540 for the server agent).

Some programs and services, when operating over network protocols, use specific ports for data exchange. By default, an enabled Windows Firewall blocks such network activity. In particular, if you try to connect from a client machine to, you may encounter an error:

« Error when performing an operation with the infobase (...). Error network access to the server (...). An attempt to establish a connection was unsuccessful, because the required response was not received from another computer within the required time, or an already established connection was terminated due to an incorrect response from an already connected computer (...) »

This error means that the 1C:Enterprise server was not found at the specified address, or the port on the server is closed (in this case, the port 1541 ).

To open the port, go to the computer where the 1C:Enterprise server is installed (in my example, this is a computer with the address 10.192.128.15 and the operating system installed on it Windows system Server 2012 R2).

Launch the Windows Firewall. You can do this by right-clicking on “ Start» ( Start), then " Control Panel» ( Control Panel) — « system and safety» ( System and Security) — « Windows Firewall » ( Windows Firewall). Or by running the command firewall.cpl(to do this, press the key combination Win + R, in the “ Open» ( Open) enter the command name and press " OK») .

In the window that opens, in the tree on the left, open the tab “ » ( Inbound Rules), and then to the menu " Actions» ( Actions) select the item “ Create a rule...» ( New Rule...).

" Wizard for creating a rule for a new incoming connection» ( New Inbound Rule Wizard). On the first page, select the type of rule ( Rule Type) « For port» ( Port) and click " Further» ( Next).

Then you need to specify the protocol (in our example it is TCP) and, directly, the port number (Specific local ports) that we are opening. Then click “ Further» ( Next).

Now let's indicate the action associated with the added rule. Let's select " Allow connection» ( Allow the connection) and click " Further» ( Next).

On next page you need to specify which firewall profiles the rule will apply to. We mark the necessary profiles with checkboxes and click “ Further» ( Next).

And finally, enter a name and description for the new rule and click “ Ready» ( Finish) to complete the wizard.

We try to connect to the 1C:Enterprise server again and see that the error remains, but the message contains a different port, 1560.

Using the method described above, we will add another allowing rule, with the name “ 1C: Work processes» for the entire range of ports with 1560 By 1591 (for 1C workflows), specifying them separated by a hyphen in step “ Protocol and ports» ( Protocol and Ports).

Now, in the snap " Windows Firewall with Advanced Security» ( Windows Firewall with Advanced Security) in the table " Rules for incoming connections» ( Inbound Rules) we should see 2 newly created rules.

Well, it should connect to the server without errors. If you need to connect to this server via , then you must also open the port 1540 .

In a similar way, rules for outgoing connections are added (Outbound Rules), prohibiting rules, rules for certain programs and protocols. You can also change any rule by opening its properties from this snap-in.

Did this article help you?