The college has a firewall that protects the computers on campus. Here’s a picture from http://www.bleepingcomputer.com/tutorials/understanding-and-using-firewalls/
But that’s too simplistic. In practice, many organizations, including Wellesley, have a DMZ between the outside internet and the internal LAN. See http://en.wikipedia.org/wiki/DMZ_%28computing%29
A machine in the DMZ is “on the internet,” in the sense that it can be directly connected to from outside machines. For example, from off-campus, you can connect directly to “cs.wellesley.edu” but not to, say, “thrush.wellesley.edu.”
Because Tempest hosts the department’s web server, we put it in the DMZ. Almost all of the rest of our machines (such as Thrush) are on the internal LAN.