Remember your regular webserver is only sending the client's web browser a URL to the internal site. This means that my machine going to your web page and gets a page and an iframe with a URL that by definition it cannot access to your internal web page.
Assuming the web server has access to the internal site, the easiest way to do this is to have a script on the webserver that fetches the requests page from the internal site and some how securely hands it out to authenticated users. This script will also have to take requests from an authenticated web client and pass them to the internal site. That sounds really complicated, untested, and limited and it seems to be the easiest way to do exactly what you want.
If you can change you exact goal slightly...
It is probably easier and more secure to setup a VPN and allow users to connect to the internal network, or at least just the internal web server. There are VPN clients that can be installed on clients ahead of time or via a web browsers add ons (activex, xpi, etc...), and can make the whole setup fairly seemless. This option will likely involve purchasing equipment and/or software, but VPNs are secure, easy and reliable.
Another alternative is to review the internal site, and ask why it is internal? Can you simply make it external? Can the code be audited for security then posted externally? Maybe the data would be safe enough behind a web login and SSL encrypted. This option could be very easy or moderately difficult depending on what the internal site is. This option also doesn't involve any software on the clients machine.