---
title: "Site-to-site tunnels"
description: "Join a whole remote network to a VPC over IPsec."
---

A site-to-site tunnel connects an entire network you run elsewhere — an AWS VPC today — to a Miget VPC over IPsec. Every workload on both sides can reach the other by address, with no client software anywhere.

<Warning>
**A tunnel costs $199/mo for as long as it exists,** and creating or removing one needs the `network:manage` permission — the built-in **Admin** role, and the workspace owner.

The price is not arbitrary. IPsec negotiates on fixed UDP ports 500 and 4500, so a peer needs an address it does not share — the first tunnel on a network permanently withdraws one from the region's pool. That pool is small. When it is empty, creating a tunnel is refused rather than queued.
</Warning>

## What you need from the far side

From your AWS VPN connection — or the equivalent on another platform:

- **The remote gateway address**, the outside address of their tunnel endpoint
- **The pre-shared key** for that tunnel
- **The remote networks**, as CIDR ranges. Anything outside them is not routed over the tunnel
- **The BGP ASN**, if the far side runs BGP

<Note>
AWS gives you a configuration with **two** tunnels for redundancy. Miget builds the first one today. Running both needs a change on the platform side that has not shipped yet, so treat the connection as a single tunnel when you plan for failure.
</Note>

## Setting one up

<Steps>
<Step title="Create the connection on Miget">
Name it, paste the remote networks, and enter the far side's gateway address and pre-shared key. The platform claims a public address for it and starts building.
</Step>
<Step title="Read the address it was given">
The connection shows a public IPv4 that belongs to it alone. This is the address the far side needs.
</Step>
<Step title="Enter it on the far side">
Configure your AWS customer gateway — or equivalent — with that address and the same pre-shared key. **The tunnel will not come up until you do.**
</Step>
<Step title="Check both ends agree">
The connection turns active once the far side answers. If it stays pending, the mismatch is almost always the pre-shared key or the remote networks.
</Step>
</Steps>

The pre-shared keys you enter are stored encrypted and are never shown again or returned by the API. If you lose one, rotate it on the far side and re-enter it here.

## Removing a tunnel

Deleting the connection tears the tunnel down and stops the $199/mo charge.

<Warning>
**The public address is not released when you delete the tunnel.** It is held by the gateway behind it, which several tunnels can share. Once the last one is gone, disable the gateway to return the address to the region's pool — until you do, it stays out of the pool and nobody else can use it.
</Warning>

<Note>
A workspace holding a tunnel it no longer uses is paying $199/mo for nothing. If a project ends, delete the connection and then disable the gateway, so the address goes back.
</Note>