I correctly setup a Hurricane Electric tunnel on a CentOS 6.5 VPS server (KVM). I use CSF (ConfigServer Security & Firewall) which acts as a wrapper for iptables and ip6tables, the default services themselves are disabled.

Tunnel interface: sit1 WAN interface: eth0

I have a IPv6 address set on the WAN, along with several IPV6ADDR_SECONDARIES.

Initially connectivity is great. I can use ping6/traceroute6 to ping and trace IPv6 sites. However after a short period of time IPv6 connectivity goes down, all IPv6 requests timeout and no communication can be made via IPv6 any longer.

If I flush the firewall i.e. disable it, everyting works again, if I restart the firewall, IPv6 connectivity works for a short while before going down again. It seems unless I flush the firewall connectivity is completely blocked until doing so.

What could be the reason for this? Do I need to add specific firewall entries in addition to the configuration provided by CSF, or am I experiencing problems because IPv6 connectivity is coming over a tunnel interface and then being accessed via the WAN (eth0)?

Thanks for any help the community can provide!

1 Answer 1


It appears I overlooked my iptables firewall, the problem doesn't appear to be with ip6tables but actually proto 41 being blocked which is required for 6in4 to work, I added the following to my csfpre.sh file:

iptables -t filter -I INPUT -p 41 -j ACCEPT
iptables -t filter -I OUTPUT -p 41 -j ACCEPT

Connectivity appears to be maintained now.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.