i was just goofing around with this so i'll toss my two cents in. Similarly, i was trying to access my sharepoint intranet server, which is not accessible via carrier, unless VPN is connected.
it seems to be completely related to DNS, in particular DNS suffix, doesnt seem to get attached to the device's WLAN adapter from DHCP, nor is there an option to add it statically.
* i tried using static ip address, so i can add static DNS servers. this didnt help.
* I added the host header "intranet.mydomain.com" on my sharepoint site. This initially connected, but it just redirected back to "http://intranet" and i do not feel like changing the URL in the web application.
* having a rooted phone: editing hosts file works just fine.
so it seems my options are either:
1) root devices to connect
2) change intranet site to include a FQDN