How to securely connect to IIS outside the firewall.

I'm looking for any ideas on how I can connect to IIS or allow IIS to
connect to the AS/400.

The problem is that the IIS server is currently hosted by an outside
provider and is outside the firewall.  Initially they are looking for info
like order status, but they want to eventually get to direct order entry
from the web.  They currently allow IIS to open up a direct read only
connection to an Oracle data base that passes through a specific port in
the firewall.

The present configuration seems way to insecure to me for any connections
to the AS/400.  If they move the IIS server in-house into the DMZ, then I
think there could be several ways to communicate.

I keep hoping they can get some infrastructure established and maybe go
with Websphere, but this type of option has been dragging on for a long
time and there doesn't seem to be any decision in the near future.

In the mean time, are there any suggestions?

Thanks.

Dave Murvin
DRM Enterprises, Inc.
davem@drme.com