I think there are some basics that we need to cover here.
Do you have two IS boxes deployed? One behind the firewall and one outside? Are you using reverse invoke?
TN is not a stand-alone component. It is basically a package, supplemented by a database, that runs within an Integration Server. You cannot have a TN without an IS.
Developer is not a run-time component. Using Developer you create services that are managed and run by IS. When a service is executed, it runs in IS, not Developer.
Your entry service will be available on the IS box that is outside the firewall. Thus, partners can post to your service just as easily as they can post to wm.tn:receive.
If there is only one IS/TN box, and it is outside the firewall, how is data flowing to get into the protected zone? If you have only one IS box, and it is outside the firewall, and it is accessing resources (database, etc.) inside the firewall, then you may have a security problem.
Does this help?
#webMethods#Integration-Server-and-ESB#webmethods-Protocol-and-Transport