Split tunneling
Only team traffic takes the tunnel.
A classic VPN drags every call, download and search through one server. Teicho splits by domain: requests to your team’s sites go through your team’s Gate and its fixed IP, and everything else goes straight to the internet, as if Teicho weren’t there.
How split by domain works
You describe what belongs to your team: an admin panel, a bastion, a wildcard such as *.internal.example.com, or an IP range for destinations without a name. Teicho compiles that into a signed config for each device, covering only what that device may reach.
When a device connects to one of those destinations, the connection goes through your Gate. Any other destination resolves and connects exactly as it would without Teicho.
Private DNS for internal names
Internal names are answered by the Teicho app from its signed config, or by your own Gate inside the tunnel. In split tunnel, lookups for everything else stay with your normal DNS, so the rest of the internet is exactly as fast as before.
Your internal names never go to a public resolver or to Teicho’s shared servers, and no other team can look them up.
Split tunnel versus a classic full-tunnel VPN
| Teicho split tunnel | Classic full-tunnel VPN | |
|---|---|---|
| What goes through the tunnel | Only your team’s destinations | Everything, from video calls to updates |
| Everyday browsing and calls | Unchanged, on the direct path | Every packet detours through the VPN server |
| Exit IP | Your team’s own static IPs, never shared | One server IP for everyone behind it |
| Allowlisting that IP | Lets in your team and nobody else | Lets in everyone who shares the server |
| When the VPN is down | Only team destinations wait; the rest keeps working | Often the whole connection stops |
Team traffic fails closed, everything else fails open
In split tunnel, ordinary traffic never depends on Teicho, so a problem on our side can’t take down your team’s internet. If your team needs everything to leave from its own IPs, full tunnel is available per Gate pool.
Team destinations are different on purpose: if none of your Gates can be reached, your assets stay closed. That is the wall doing its job.
Two Gates, so one can fail
A pool has two dedicated Gates in two locations, each with its own static IP. You allowlist both. If one goes down, the Teicho app switches to the other on its own; standard clients follow the order in their profile.
The Teicho app, and standard clients
Split by domain with automatic failover comes with the Teicho app on macOS, Windows, Linux, iOS, Android and ChromeOS.
Servers, CI runners and managed fleets can use the standard WireGuard client. Teicho generates a profile per device, and where the operating system supports per-domain DNS, the profile includes it.
Devices that can’t run WireGuard can use IKEv2, once you turn it on for a Gate pool, with a per-device certificate profile for Apple, Windows, Android or Linux. An IKEv2 profile connects to one Gate and routes your assets by their IP ranges, without the app’s automatic failover.
FAQ
Split tunneling, briefly.
Do we need the Teicho app for split tunneling?
For split by domain with automatic failover, yes. The standard WireGuard client works with generated per-device profiles, and get per-domain DNS where the operating system supports it.
Will Teicho slow down our internet?
Traffic that isn’t for your team never touches Teicho, so it is exactly as fast as before. Team traffic takes one extra hop, through your Gate.
What happens when a Gate goes down?
With two Gates, the Teicho app moves to the other one and team access continues. Everything that isn’t a team destination is unaffected either way.
Put a wall around what matters.
Teicho is in early access. Tell us what you want to protect and we’ll be in touch.