> Am I missing something, like 'How is IIS going to
> know an EJB message?'
This one is the right answer :)
The point is, IIS is a web-server, meaning it speaks only HTTP. That's why you need servlets (Tomcat) to be able to execute Java code in your web-server.
Bottom line, if you want to access ejbs from your browser, you need to either write a servlet which is your gateway to your ejbs (normally, your servlet handles your GUI so it is the one making ejb business calls)
Or, you have an HTTP protocol which can encapsulate remote server calls, this is the goal of SOAP (but I don't know the details of SOAP)
SOAP is rpc over http (or smtp theoritically). It allows you to make RPC calls using http as transport thus avoiding firewall issues.
Apache/IIS can redirect http calls to Tomcat(servlet) which in turn can access EJBs running on JBoss or any other app server.
Or you can define RPC interface on top of EJB interface (using WSDL/SOAP) and let soap rpc router handle client requests and reroute them to EJBs.