A site-to-site tunnel connects an entire network you run elsewhere — an AWS VPC today — to a Miget VPC over IPsec. Every workload on both sides can reach the other by address, with no client software anywhere.
A tunnel costs $199/mo for as long as it exists, and creating or removing one needs the network:manage permission — the built-in Admin role, and the workspace owner.The price is not arbitrary. IPsec negotiates on fixed UDP ports 500 and 4500, so a peer needs an address it does not share — the first tunnel on a network permanently withdraws one from the region’s pool. That pool is small. When it is empty, creating a tunnel is refused rather than queued.

​
What you need from the far side

From your AWS VPN connection — or the equivalent on another platform:
  • The remote gateway address, the outside address of their tunnel endpoint
  • The pre-shared key for that tunnel
  • The remote networks, as CIDR ranges. Anything outside them is not routed over the tunnel
  • The BGP ASN, if the far side runs BGP
AWS gives you a configuration with two tunnels for redundancy. Miget builds the first one today. Running both needs a change on the platform side that has not shipped yet, so treat the connection as a single tunnel when you plan for failure.

​
Setting one up

1

Create the connection on Miget

Name it, paste the remote networks, and enter the far side’s gateway address and pre-shared key. The platform claims a public address for it and starts building.
2

Read the address it was given

The connection shows a public IPv4 that belongs to it alone. This is the address the far side needs.
3

Enter it on the far side

Configure your AWS customer gateway — or equivalent — with that address and the same pre-shared key. The tunnel will not come up until you do.
4

Check both ends agree

The connection turns active once the far side answers. If it stays pending, the mismatch is almost always the pre-shared key or the remote networks.
The pre-shared keys you enter are stored encrypted and are never shown again or returned by the API. If you lose one, rotate it on the far side and re-enter it here.

​
Removing a tunnel

Deleting the connection tears the tunnel down and stops the $199/mo charge.
The public address is not released when you delete the tunnel. It is held by the gateway behind it, which several tunnels can share. Once the last one is gone, disable the gateway to return the address to the region’s pool — until you do, it stays out of the pool and nobody else can use it.
A workspace holding a tunnel it no longer uses is paying $199/mo for nothing. If a project ends, delete the connection and then disable the gateway, so the address goes back.