The /64 tunnel is up and passing correct traffic - I can ping6 in and out, ssh in and out over the v6 address, and traceroute6 TO the tunnel endpoint, but I can't traceroute6 OUT. I have a couple of IPv6 pops in different locations with different allocations that can all ping6/traceroute6/hit traffic with each other fine. This sixxs endpoint with IPv6 2001:4978:f:20b::2 does everything but traceroute6 out. I just get timeouts. Example to the endpoint: traceroute to 2001:4978:f:20b::2 (2001:4978:f:20b::2) from 2001:470:c11a::1, 30 hops max, 16 byte packets 1 bmt-2.tunnel.tserv9.chi1.ipv6.he.net (2001:470:1f10:47f::1) 4.982 ms 5.107 ms 3.896 ms 2 gige-g3-4.core1.chi1.he.net (2001:470:0:6e::1) 4.513 ms 7.491 ms 3.626 ms 3 2001:470:0:7f::2 (2001:470:0:7f::2) 4.958 ms 5.738 ms 3.748 ms 4 unassigned.v6.your.org (2001:4978:1:400:202:b3ff:feb4:5974) 15.401 ms 9.061 ms 10.965 ms 5 cl-524.chi-02.us.sixxs.net (2001:4978:f:20b::2) 7.79 ms 6.881 ms 10.981 ms Failure in the reverse direction (from the sixxs endpoint): traceroute to 2001:470:c11a::1 (2001:470:c11a::1) from 2001:4978:f:20b::2, 30 hops max, 16 byte packets 1 * * * 2 * * * etc etc. This is a debian etch box, no ipv6 firewall rules in place at the moment.