Intranet, extranet, internet
The three differ above all in who is allowed in:
- Intranet: for the organisation's own staff only.
- Extranet: additionally for a named circle of external partners – suppliers, customers, service providers.
- Internet: open to everyone.
Technically all three rest on the same protocols. The difference lies in access control, not in the technology. An extranet is therefore not a separate network but a bounded area with its own rules for authentication and authorisation.
How access is provided
Over a VPN
The classic route is a Virtual Private Network: the connection between partner and company network is tunnelled through the public internet in encrypted form. Site-to-site tunnels suit permanent connections between locations; client VPNs suit individual staff at partner firms.
Over the web
More common today is a web portal reached over HTTPS, with access governed by user accounts. Multi-factor authentication, single sign-on via SAML or OIDC and role-based permissions take the place of the VPN tunnel.
Without the internet
An extranet does not have to be connected to the internet at all. A completely separate network is equally possible, reached over a leased line or by direct dial-in.
Network segmentation
So that an extranet account does not inadvertently open the whole intranet, the released systems belong in a network segment of their own. A firewall governs which services can be reached from there at all. Access to internal systems runs through clearly defined interfaces rather than open network paths.
Typical use cases
- Supplier portals: exchanging orders, delivery notes and invoices.
- Customer portals: order status, documents and support cases.
- Project collaboration: shared storage and schedules with external service providers.
- Sales partners: providing price lists, product data and training material.
- Connecting branches: linking sites without their own server infrastructure to central systems.
Benefits and limits
Benefits: shorter coordination paths, less manual data transfer, traceable access through logging, and a clearly bounded slice of data instead of full access. Geographical distance stops mattering, and communication along the whole value chain speeds up – time saved is money saved.
Limits: every external route enlarges the attack surface. Permissions go stale when partnerships end and accounts remain. And running an extranet takes continuous care – certificates, patches, and a regular review of who should still have access.
Security in an extranet
- Encryption: TLS for web access, IPsec or WireGuard for tunnelled connections.
- Strong authentication: multi-factor rather than passwords alone.
- Least privilege: partners see only the data they need for their task.
- Regular recertification: review permissions on a schedule and withdraw them.
- Logging: record access and watch for unusual patterns.
- Data protection: where personal data is shared, a legal basis is needed and, for processing on your behalf, a corresponding contract.