VS2010 remote debugging and Windows 7 firewall

*Update, 2011/09/16: The issue has been fixed in the next major release of Visual Studio.

I've had some trouble getting remote debugging going for a development server at work. Turns out there are some oddities in the way VS 2010 creates and manages the firewall entries that let the remote machine connect back to the local computer. You'd might want to read this before checking out the MSDN articles:  How to: Set Up Remote Debugging, How to: Configure the Windows 7 Firewall for Remote Debugging.

I was working with a development server that had the remote debugging monitor installed. Others have been debugging on the server, so I was sure that the server was set up correctly. I was pretty sure my problems were caused by the setup on my local machine.

If you lack firewall rules for remote debugging, VS2010 detects this and asks you what to do:

Without giving it much thought I chose to "Unblock remote debugging from computers on the local network (subnet)". After all, the development server was somewhat "local." The remote debugging monitor reported that I connected to the server, but nothing more happened and I timed out with this error message: 

Unable to connect to the Microsoft Visual Studio Remote Debugging Monitor named 'xxxxxxx'. The Visual Studio Remote Debugger on the target computer cannot connect back to this computer. A firewall may be preventing communication via DCOM to the local computer.

I then realized that subnet was probably a keyword here, as the server was in the same domain but on a different subnet.



The problem was, I couldn't find a way to trigger the firewall configuration screen again so I had to resort to the MSDN articles mentioned above. If you read the instructions on MSDN, you'll learn that you should add VS2010 to the Allow programs and features list in the Windows 7 firewall settings.

Alas, Microsoft Visual Studio was there, but it was all gray and disabled (I've hidden my other firewall rules). It was impossible to change its settings, so this was a dead end. After looking through the firewall rules found under "Advanced Settings", I stumbled across the inbound rules created by VS2010 (I've rearranged the columns for readability):

If you delete these rules, restart VS2010, and attempt a remote debugging session, you'll be asked again to set up the firewall. I'f you chose "Unblock remote debugging from any computer", you'll get the following rules

The firewall now allows any machine to connect to your Visual Studio remote debugging ports. It doesn't seem like a very secure setting, especially if you connect your computer to untrusted networks every once in a while. And VS2010 still wasn't configurable in the Allow programs and features list, and I wasn't able to get the remote debugging session going. I kept running into the "Unable to connect" error. After tweaking the rules I was finally able to get everything up an running. I had to set the rule to apply to the "Domain" profile, since my computer was part of a domain.

Here are the resulting rules. These would probably make sense for any computer which is part of a domain (though you should tighten up the "Remote address" setting).

After manually updating the firewall rules, VS2010 also became configurable in the Allow programs and features list!

The VS2010 automagic firewall configuration feels somewhat unpolished. I consider it a bug that the firewall rules created by the wizard render VS2010 unconfigurable in Allow programs and features list. For the record, my VS2010 is fully patched.

I didn't find much help on the Internet so I decided to blog this — I assume I'm not the only fast clicking guy on the planet trying to remote debug with VS2010 from a Windows 7 computer that's part of a domain.