My understanding of this technet article, per the page that brought me there*, is that I can configure the Windows Firewall to allow all inbound traffic on any port being used by a specified executable.
I realize the defacto answer is likely to be "Don't do this", so please understand; I'm running Visual Studio and IIS Express inside a virtual machine, and want to be able to connect from the host OS for testing purposes, and thus not really concerned with the security implications of opening all ports being used by IIS Express.
I created an inbound rule with Program set to
%ProgramFiles% (x86)\IIS Express\iisexpress.exe, which is the executable running according to the task manager. All other rule specs are left empty (any local address, any remote address, and local port, any remote port, "any" allowed users, "any" allowed computers). Yet, the connection only works if I have a rule for the specific port being served up by IIS Express.
Since it would make my life easier (and largely on principle since technet says it should work), I'd rather not have to add a firewall rule for each app I create.
* Task "Create a rule that allows a program to listen for and accept inbound network traffic on any ports it requires."