Proto 41 should indeed be enough, note protocol, not port ;) IF=eth0 POP=<pop's IPv4 address> iptables -A INPUT -i ${IF} --proto 41 --src ${POP} -j ALLOW iptables -A OUTPUT -o ${IF} --proto 41 --dst ${POP} -j ALLOW I tend to reverse that rule and drop anything not from/to the POP btw. Though that was a 'requirement' in the old tunnel stacks :) For the rest, use tcpdump, and watch those counters. One could also use the LOG statement ofcourse to check which packets get dropped etc... Maybe handy for linux users: iptables --new LDROP iptables -A LDROP --proto tcp -j LOG --log-level info --log-prefix 'TCP-Drop:' iptables -A LDROP --proto udp -j LOG --log-level info --log-prefix 'UDP-Drop:' iptables -A LDROP --proto icmp -j LOG --log-level info --log-prefix 'ICMP-Drop:' iptables -A LDROP --proto 41 -j LOG --log-level info --log-prefix '6in4-Drop:' iptables -A LDROP -j DROP Now where-ever you had DROP, replace it with LDROP and dropped packets are logged, nicely notated what it was. Ofcourse there are more variants to add so you can even see more information etc. See LARTC