Wireshark/tcpdump is your friend here, that way you can actually see what the wire is doing. Just set up a proto-41 tunnel between two hosts and send some traffic, that should pop up traffic or ICMP unreachables which should show what is wrong; of course when traffic is filtered you don't see a thing. Actually, unless there is a firewall on the remote box which is dropping packets, you can just configure a tunnel on your host and then set the remote to any host on the internet, which should then send back ICMP "Protocol Unreachables" as they don't have a tunnel configured to your host. If no such packets are sent back, then well, it is filtered somewhere. Another way to do this is by using hping3 which just sends the packets. Of course note that 6to4 has this awesome great concept of anycast, but because of anycast debugging it is horrible as you have no idea on how packets come back.