Well, "LAN-IP" and "localhost" would be your private IP address. I was asking about how it worked from the Internet side when you used your public IP address. Does that work? You already said it worked from the inside in your original post. You want access from the Internet side, right?
If you want anonymous logon (99 percent do!) you need to...
IIS Manager | | Properties | Directory Security | "Enable anonymous access"
By default, the username assigned to anonymous access is IUSR_. It should already be filled in, to include the password field (although I suppose the password is blank, I dunno since I left mine at the default).
Yes. I did it for years before upgrading to W2K3 (better). If you run a web server on W2K make SURE and download and install the MS add-on product called URL SCAN. 99 percent of URL SCAN's features were built into W2K3. Using URL SCAN (properly configured) will keep you in good shape on W2K. Also use NTFS file permissions to protect the rest of the W2K files and file system using system hardening techniques (you can find recommendations all over the net about Operating System Hardening).
Although zone alarm is better than nothing, what you really want is a "network" firewall, not a "personal" firewall (like zone alarm). There are many network firewalls out there. Most any will do. Depends on your risk factor, of course, but most are pretty good. A router with NAT and Stateful Packet Inspection might be good enough ($50-60). Maybe you already have that implemented in your DSL setup???
As Duane also mentioned, you should be aware that W2K Workstation as well as Windows XP Professional allow only 10 inbound connections. And be aware that ONE CLIENT can take up all 10 connections in some situations. Although the "norm" for one client to connect is two connections.
-Frank