You might have a static IP, but you are still behind a NAT. And even if you configure DMZ mode, not all NAT boxes then understand how to forward proto-41 packets properly. I don't know what you mean with the above lines, because the statement of 'nat for X' is quite ambigues, does it imply that every other port is not NATted? With the '41 tcp/udp' you probably mean protocol 41, which is the one used for static tunnels (6in4). The other ports should only go for outbound connections and thus should be included in the default NAT rules anyway. When using a static tunnel then you don't use the heartbeat port (3740) or the AYIYA port (5072). As you have a static tunnel, you don't need to use AICCU either as you can just configure it using the OS-supplied configuration. I guess though your problem primarily lies at the fact that you are behind a NAT. proto-41 tunnels don't easily work behind them unless you can configure your NAT box to do the proper forwarding. Like above, you probably mean protocol 41.

Jeroen Massar thanks for your reply, "nat for" is in my router im setup nat rules from real IP to 192.168.1.60(my centos box) my router: Livebox v2 from Orange Carlos

All ok now just need to set : # Local IPv4 Override (default: none) # Overrides the IPv4 parameter received from TIC # This allows one to configure a NAT into "DMZ" mode and then # forwarding the proto-41 packets to an internal host. # # This is only needed for static proto-41 tunnels! # AYIYA and heartbeat tunnels don't require this. local_ipv4_override 192.168.1.60 in /etc/aiccu.conf will test it a little more and write a how to for all thanks again, Carlos