I've been running a static tunnel to my local firewall for awhile now, and just recently got a SixXS subnet added to it for my LAN hosts. My traditional IPv4 network has run NAT behind the firewall with some standard iptables rules thrown in. All seems to be working well, but my concern is that my unfamiliarity with both tunneling and IPv6 could inadvertently leave my hosts open to the IPv6 network. I don't want to rely on host-based firewalling alone to prevent issues; I'm much more comfortable using my existing border firewall as the main access control point to the internet. I'm currently running the following ip6tables rules on my firewall/tunnel endpoint/subnet router. eth0 is the LAN interface. *filter # Drop incoming data by default -P INPUT DROP -P FORWARD DROP -P OUTPUT ACCEPT # Accept any traffic from the LAN -A INPUT -i lo -j ACCEPT -A INPUT -i eth0 -j ACCEPT -A FORWARD -i eth0 -j ACCEPT # Accept ping from WAN to router -A INPUT -p ipv6-icmp -i sixxs -j ACCEPT # Accept established connections from WAN -A INPUT -m state --state RELATED,ESTABLISHED -j ACCEPT -A FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT COMMIT This all looks logically sound to me, and as far as I can tell, my LAN and firewall should be protected against any uninitiated incoming traffic. Can someone else verify this configuration? Am I missing anything?