Outlook Web Access

We have Outlook Web Access loaded on an IIS server OUTSIDE of the firewall. The Exchange server and domain controller are on the INSIDE of the firewall. We have opened up 3 ports between the IIS server and the Exchange server in the firewall but OWAwon’t work because the usernames/passwords won’t authenticate. Keep getting HTTP Error 401.1 Unaurthorized:Logon Failed.
Do we also need to open ports in the firewall between the domain controller and the IIS server so the usernames can be authenticated?

Running Exchange 5.5 SP3
Running IIS 4.0 on an NT 4.0 server

Any suggestions would be great.