Create Virtual Directory from DMZ to LAN

Hi,
I have a Windows 2000 server [IIS5] inside a DMZ with no access onto
the LAN except required ports [SQL etc]. The LAN server is part of a
Windows 2003 domain while the IIS machine is non-domain. I need to
upload files from our website and after trying to create the Virtual
Directory ran into some problems.

1 - Which firewall port do I need to open to allow access from DMZ to
LAN and how safe is it opening this port?

2 - How can I add ACL settings for the non domain machine into shared
directory on the domain machine?

3 - Am I approaching this incorrectly, and a better method exists?

Regards

Gary