Trouble connecting a Ubuntu system to IPv6 tunnel over NAT

Question

I'm trying to set up an IPv6 tunnel, via Hurricane Electric's tunnel-broker service. I've configured my system using their example commands:

# $ipv4a = tunnel server's IPv4 IP
# $ipv4b = user's IPv4 IP
# $ipv6a = tunnel server's side of point-to-point /64 allocation
# $ipv6b = user's side of point-to-point /64 allocation

ip tunnel add he-ipv6 mode sit remote $ipv4a local $ipv4b ttl 255
ip link set he-ipv6 up
ip addr add $ipv6b dev he-ipv6
ip route add ::/0 dev he-ipv6

And have configured my desktop to be in my NAT router's DMZ. The router is running Tomato firmware.

But I can't ping any IPv6 services:

$ ping6 -I he-ipv6 '2001:470:1f04:454::1'
PING 2001:470:1f04:454::1(2001:470:1f04:454::1) from 2001:470:1f04:454::2 he-ipv6: 56 data bytes
From 2001:470:1f04:454::2 icmp_seq=1 Destination unreachable: Address unreachable
From 2001:470:1f04:454::2 icmp_seq=2 Destination unreachable: Address unreachable

I can ping my local address:

$ ping6 -I he-ipv6 '2001:470:1f04:454::2'
PING 2001:470:1f04:454::2(2001:470:1f04:454::2) from 2001:470:1f04:454::2 he-ipv6: 56 data bytes
64 bytes from 2001:470:1f04:454::2: icmp_seq=1 ttl=64 time=0.037 ms
64 bytes from 2001:470:1f04:454::2: icmp_seq=2 ttl=64 time=0.039 ms

I don't know much about routing, but results I found online suggested the output of ip -6 route and ip addr could be useful:

$ ip -6 route
2001:470:1f04:454::/64 via :: dev he-ipv6  proto kernel  metric 256  mtu 1480 advmss 1420 hoplimit 4294967295
fe80::/64 dev virbr0  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 dev eth1  proto kernel  metric 256  mtu 1500 advmss 1440 hoplimit 4294967295
fe80::/64 via :: dev he-ipv6  proto kernel  metric 256  mtu 1480 advmss 1420 hoplimit 4294967295
default dev he-ipv6  metric 1024  mtu 1480 advmss 1420 hoplimit 4294967295

$ ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN 
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 100
    link/ether 00:1c:c0:a1:98:b2 brd ff:ff:ff:ff:ff:ff
    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth1
    inet6 fe80::21c:c0ff:fea1:98b2/64 scope link 
       valid_lft forever preferred_lft forever
3: virbr0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UNKNOWN 
    link/ether 36:4c:33:ab:0d:c6 brd ff:ff:ff:ff:ff:ff
    inet 192.168.122.1/24 brd 192.168.122.255 scope global virbr0
    inet6 fe80::344c:33ff:feab:dc6/64 scope link 
       valid_lft forever preferred_lft forever
4: vboxnet0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN qlen 1000
    link/ether 00:76:62:6e:65:74 brd ff:ff:ff:ff:ff:ff
5: pan0: <BROADCAST,MULTICAST> mtu 1500 qdisc noop state DOWN 
    link/ether 7e:29:5e:7c:ba:93 brd ff:ff:ff:ff:ff:ff
6: sit0: <NOARP> mtu 1480 qdisc noop state DOWN 
    link/sit 0.0.0.0 brd 0.0.0.0
7: he-ipv6@NONE: <POINTOPOINT,NOARP,UP,LOWER_UP> mtu 1480 qdisc noqueue state UNKNOWN 
    link/sit 24.130.225.239 peer 72.52.104.74
    inet6 2001:470:1f04:454::2/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::1882:e1ef/128 scope link 
       valid_lft forever preferred_lft forever

Answer 1

Have you checked your ip6tables? I had a problem like that and it turned out my ip6tables were all set to drop.

If you aren't running an ip6 firewall, you can clear them like this:

ip6tables -P INPUT ACCEPT
ip6tables -P OUTPUT ACCEPT
ip6tables -P FORWARD ACCEPT

Note that this completely disables your IPv6 firewall.