When you connect to your company's "remote access site", your computer is launching a Virtual Private Network (VPN) connection. This first installs a virtual network adapter called a 'tunnel' which is then configured to securely connect to your company's VPN server; at the company server, the other end of the tunnel emits your packets onto the corporate network. It then is changing the settings on your network adapters to route all network traffic to the tunnel interface**. This routing change means all traffic to and from your machine is routed through the company's network. This helps prevent your box from being used as a real-time relay to infiltrate or exfiltrate data, or to act as a remote control device for a hacker.
One of the side effects of using a VPN tunnel is that your packets on the corporate network have a different IP address than they do when you're connected locally. The VPN server uses Network Address Translation (NAT) to make your packets appear inside the network. Because the packets have an IP address associated with the VPN product, they are recognizable to all your network devices as having come from the VPN. That means the company's firewalls can recognize traffic originating from the VPN tunnel and can separate it from ordinary network traffic, and they can apply different rules to it.
If they allow web surfing on the machine while you're locally on the network, but not when the same machine is connected to the VPN, the firewall most likely has different rules for VPN traffic.
If you'll indulge me in some speculation, I can picture a scenario that might be taking place at your shop. Companies that provide network access to contractors or vendors often do not allow them web access for various reasons. The company may lack control over the contractor's computer, meaning the company may not be able to guarantee the contractor machines adhere to company security standards, such as having correct antivirus systems installed. Or they may be preventing the contractors from consuming a lot of bandwidth. Or they may be afraid of a contractor's machine connecting to a rogue web page that could perform a relay attack. And your company may identify your contractor's systems by assigning them IP addresses from a specific range, allowing them to write contractor specific rules in the firewalls.
Now, if there is only a single VPN used by both employees and contractors alike, there would be no way for the firewall to distinguish IP packets coming from the VPN that came from contractor computers vs. those of employee computers. So they may be applying the contractor rules to all VPN traffic. This would ensure the continued compliance of the contractors (important for auditors,) while causing an inconvenience to employees. Most companies do a better job of configuring their VPNs and firewalls than that, but anything's possible. It may even have been done on a recommendation from a security auditor.
For solutions, check with your company's help desk first. If your company offers a non-transparent web proxy for employee computers, you could ask to have your browser's options reconfigured to use the proxy. But don't just change things on your own; you might run afoul of corporate security policies.
** You can see this by opening a command line and typing "route print", and noting which traffic is being directed to which interface; you can also compare the output of that to the output run at a time when you're not connected to the company network.