A VPC keeps your workloads off the public internet. The VPN is how you get in — from your own machine, or from a network you already run.
Pricing. Each gateway you enable costs 29/mo∗∗—pergateway,notperVPC,soaVPCrunningbothWireGuardandTailscaleischargedtwice.A[site−to−sitetunnel](/networking/private−networks/site−to−site)is∗∗29/mo** — per gateway, not per VPC, so a VPC running both WireGuard and Tailscale is charged twice. A [site-to-site tunnel](/networking/private-networks/site-to-site) is **199/mo each, because each one permanently holds a public IPv4. Enterprise plans include both.

​
Choosing a terminator

A VPC runs at most one of each. WireGuard is the right default for people; the other two are for workspaces that already have the platform in question.

​
WireGuard

The platform runs the server side. You add a device per person or per machine, and hand them a configuration file.
1

Enable WireGuard on the VPC

The platform books a public address and a port for it. Nothing else is needed.
2

Add a device

Give it a name — lowercase letters, numbers and hyphens. The platform generates the key pair, keeps only the public half, and registers the peer.
3

Download the configuration, once

When the device turns active, download its .conf file and give it to whoever will use it.
4

Import it

wg-quick up ./laptop.conf, or import the file into the WireGuard app.
The configuration can be downloaded exactly once.The private key in that file is never stored. It is generated when you add the device, held for 15 minutes, and destroyed the moment the file is downloaded — so nobody, including Miget, can produce it again.If the download is lost, or the 15 minutes pass without it, delete the device and add a new one. That is the whole recovery procedure.
Once connected, the device gets an address inside the VPC’s client pool and uses the VPC’s resolver, so migetapp.internal names resolve as they do for an attached workload. Revoking a device cuts it off as soon as the change reaches the gateway.

​
Tailscale

The VPC joins your tailnet as a node. You need an auth key from your Tailscale admin console.
Create the auth key tagged, reusable and ephemeral — Tailscale applies the tag from the key, and an ephemeral key means a restarted gateway leaves no dead node behind. The gateway accepts the routes your tailnet advertises, and advertises the VPC’s own range into it.
Because the networks behind a tailnet live in your configuration rather than the platform’s, Tailscale needs peer routes before anything behind it is reachable from inside the VPC.

​
Cloudflare WARP

The VPC connects to your Cloudflare Zero Trust organisation. You need the team name and a service token — client ID and secret. Like Tailscale, WARP needs peer routes for the networks behind it.
Service tokens and auth keys are stored encrypted and are never shown again after you enter them, and never returned by the API. Rotate them in Cloudflare or Tailscale and re-enter them here.

​
Peer routes

A peer route tells the VPC that a particular IPv4 range lives behind a particular terminator. Only Tailscale and Cloudflare WARP need them. WireGuard’s client pool and an IPsec tunnel’s remote networks are already known to the platform, so it adds those itself. You can still add a route for any terminator, and an unnecessary one is harmless: a route naming a gateway that is not running is dropped rather than installed, because pointing the router at it would blackhole the traffic instead of letting it take the default path.
Applying routes restarts every workload attached to the VPC. Each change re-annotates the pods, and they roll.That is why routes are staged rather than applied one at a time: add every range you need, then apply once and pay the restart once.
Removing a route that was never applied costs nothing. Removing one that was applied restarts the workloads again.