---
title: "VPN access"
description: "Reach a private network from a laptop, a tailnet or Cloudflare Zero Trust."
---

A VPC keeps your workloads off the public internet. The VPN is how you get in — from your own machine, or from a network you already run.

<Info>
**Pricing.** Each gateway you enable costs **$29/mo** — per gateway, not per VPC, so a VPC running both WireGuard and Tailscale is charged twice. A [site-to-site tunnel](/networking/private-networks/site-to-site) is **$199/mo** each, because each one permanently holds a public IPv4. Enterprise plans include both.
</Info>

## Choosing a terminator

| | Use it when | Costs |
|---|---|---|
| **WireGuard** | Individual people need in — laptops, a phone, a CI runner | Included in the $29 |
| **Tailscale** | You already run a tailnet and want the VPC to join it as a node | Included in the $29 |
| **Cloudflare WARP** | You already run Cloudflare Zero Trust | Included in the $29 |
| **IPsec** | A whole remote network needs in, such as an AWS VPC | $199/mo per tunnel, plus a public address for the network |

A VPC runs at most one of each. WireGuard is the right default for people; the other two are for workspaces that already have the platform in question.

## WireGuard

The platform runs the server side. You add a **device** per person or per machine, and hand them a configuration file.

<Steps>
<Step title="Enable WireGuard on the VPC">
The platform books a public address and a port for it. Nothing else is needed.
</Step>
<Step title="Add a device">
Give it a name — lowercase letters, numbers and hyphens. The platform generates the key pair, keeps only the public half, and registers the peer.
</Step>
<Step title="Download the configuration, once">
When the device turns active, download its `.conf` file and give it to whoever will use it.
</Step>
<Step title="Import it">
`wg-quick up ./laptop.conf`, or import the file into the WireGuard app.
</Step>
</Steps>

<Warning>
**The configuration can be downloaded exactly once.**

The private key in that file is never stored. It is generated when you add the device, held for **15 minutes**, and destroyed the moment the file is downloaded — so nobody, including Miget, can produce it again.

If the download is lost, or the 15 minutes pass without it, delete the device and add a new one. That is the whole recovery procedure.
</Warning>

Once connected, the device gets an address inside the VPC's client pool and uses the VPC's resolver, so `migetapp.internal` names resolve as they do for an attached workload.

Revoking a device cuts it off as soon as the change reaches the gateway.

## Tailscale

The VPC joins your tailnet as a node. You need an auth key from your Tailscale admin console.

<Note>
Create the auth key **tagged, reusable and ephemeral** — Tailscale applies the tag from the key, and an ephemeral key means a restarted gateway leaves no dead node behind. The gateway accepts the routes your tailnet advertises, and advertises the VPC's own range into it.
</Note>

Because the networks behind a tailnet live in **your** configuration rather than the platform's, Tailscale needs [peer routes](#peer-routes) before anything behind it is reachable from inside the VPC.

## Cloudflare WARP

The VPC connects to your Cloudflare Zero Trust organisation. You need the team name and a service token — client ID and secret.

Like Tailscale, WARP needs [peer routes](#peer-routes) for the networks behind it.

<Note>
Service tokens and auth keys are stored encrypted and are never shown again after you enter them, and never returned by the API. Rotate them in Cloudflare or Tailscale and re-enter them here.
</Note>

## Peer routes

A peer route tells the VPC that a particular IPv4 range lives behind a particular terminator.

Only **Tailscale and Cloudflare WARP** need them. WireGuard's client pool and an IPsec tunnel's remote networks are already known to the platform, so it adds those itself.

You can still add a route for any terminator, and an unnecessary one is harmless: a route naming a gateway that is not running is dropped rather than installed, because pointing the router at it would blackhole the traffic instead of letting it take the default path.

<Warning>
**Applying routes restarts every workload attached to the VPC.** Each change re-annotates the pods, and they roll.

That is why routes are *staged* rather than applied one at a time: add every range you need, then apply once and pay the restart once.
</Warning>

Removing a route that was never applied costs nothing. Removing one that was applied restarts the workloads again.