How it works
Three parts, and only one of them carries your traffic.
Teicho is a control plane that holds your rules, Towers that hand out signed configs, and Gates that carry your team’s traffic to your assets from fixed IPs. In split tunnel, the default, everything else your people do online never touches Teicho.
The three parts
Pick what happens, step through it, and take parts down to see what keeps working. Click any part of the picture for what it does and what it can see.
Control plane
Your console and API: people, groups, assets, access rules, the audit log.
- Run by
- Teicho
- Sees your traffic
- Never
Tower
Hands each device its signed config, connects your Gates to our control plane, and relays traffic for Gates your devices can’t reach directly. It never sees your traffic in the clear or your DNS lookups.
- Run by
- Teicho, shared or dedicated to you
- Sees your traffic
- Never. Relayed traffic stays encrypted end to end
Gate
Carries your team’s traffic to your assets from fixed public IPs, and enforces your access rules.
- Run by
- You, on your own Linux server
- Sees your traffic
- Only your own team’s, on its way to your assets
What happens when someone opens a team site
The app decides mainly by domain name; IP ranges work for destinations without a name. List your team sites once and they work on every device; a site not on the list never enters the tunnel.
- Laptop
Look up admin.acme.dev
The Teicho app sees a team domain and routes it to your Gate.
- Laptop
Send it over WireGuard
The request travels encrypted to your team’s Gate. If the network blocks UDP, the app sends the same tunnel over TLS on port 443.
- Gate
Check the rules
The Gate checks that this person may reach this asset.
- Gate
Forward from your fixed IP
The request leaves from your Gate’s static IP, the only one your asset allows.
- Asset
Answer
admin.acme.dev sees an allowlisted IP and responds; the answer comes back through the tunnel.
- Laptop
Everything else goes direct
news.example.com, video calls and downloads skip Teicho entirely.
Where your Gates run, and how devices reach them
Every Gate belongs to one team and is never shared. A pool has two Gates in two locations, so losing one doesn’t cut your team off. Each pool has a daily maintenance window you pick, and Gates restart one at a time, after open connections move over.
On your own server
Any Linux server in your cloud account or office, joined with one command.
Behind NAT
No inbound port needed: devices reach your Gate through a Tower relay, still encrypted end to end.
On networks that block UDP
Devices connect with WireGuard. Where UDP is blocked, the Teicho app carries the same tunnel over TLS 1.3 on port 443, looking like ordinary HTTPS, and returns to UDP when it can. On by default for each pool.
Without the app
Turn on IKEv2 for a pool, off by default, and devices that can’t run the app connect with a per-device certificate profile for Apple, Windows, Android or Linux. On the Business plan, IKEv2 also links an office or cloud network to your Gate.
Who sees what
| Control plane | Tower | Gate | Your device | |
|---|---|---|---|---|
| Your team’s traffic | No | No, only encrypted packets when relaying | Yes, its own team’s only | Yes |
| Device private keys | No, only public keys | No | No | Its own only |
| Team domain lookups | No | No, Towers run no DNS resolver | Yes, your own Gate, inside the tunnel | Yes |
| Everything else you browse | No | No | No | Yes |
| Connection logs | Stores them for your audits | No | Start, end, destination and bytes; never contents or URLs | No |
Configs are signed with your team’s own key. A Tower can delay a config but can’t forge one, and a modified client gains nothing, because the Gate enforces the rules.
If something goes wrong
A Teicho outage never opens your assets to anyone else. Team sites wait until a Gate is back, and everything else keeps working.
| If this is down | Your team sites | Everything else |
|---|---|---|
| Control plane | Keep working on the last config | Unaffected |
| One Tower | The app switches to the next Tower | Unaffected |
| UDP, on a network that blocks it | The app switches to WireGuard over TLS on port 443 | Unaffected |
| One Gate of your pool | The app moves to the other Gate | Unaffected |
| Both Gates | Wait until a Gate is back | Unaffected |
Dedicated Towers
Towers are shared by default: they never carry anyone’s traffic in the clear, and each team’s configs are kept apart. If your policies require it, a dedicated Tower pair serves only your team, in the regions you choose, with its own IPs and your own hostname. It is a paid add-on; ask us for a quote.
Put a wall around what matters.
Teicho is in early access. Tell us what you want to protect and we’ll be in touch.