title: How to allow protocol-41 (6in4) through the GCE firewall?
body: <p>As a stop-gap until Google supports <a href="https://code.google.com/p/google-compute-engine/issues/detail?id=8" rel="noreferrer">native IPv6 on Google Compute Engine</a>, I'd like to configure a <a href="https://en.wikipedia.org/wiki/6in4" rel="noreferrer">6in4 (IP protocol 41) tunnel</a>.</p>
  
  <p>I added a firewall rule to allow protocol 41 on my VM's network:</p>
  
  <pre><code>Name        Source tag / IP range  Allowed protocols / ports  Target tags
  allow-6in4  216.66.xxx.xxx         41                         Apply to all targets
  </code></pre>
  
  <p>And configured the tunnel in <code>/etc/network/interfaces</code>:</p>
  
  <pre><code>auto 6in4
  iface 6in4 inet6 v4tunnel
    address 2001:470:xxxx:xxxx::2
    netmask 64
    endpoint 216.66.xxx.xxx
    gateway 2001:470:xxxx:xxxx::1
    ttl 64
    up ip link set mtu 1280 dev $IFACE
  </code></pre>
  
  <p>And <code>ping6 2001:470:xxxx:xxxx::1</code> and verified that 6in4 traffic was outbound:</p>
  
  <pre><code>$ sudo tcpdump -pni eth0 host 216.66.xxx.xxx
  tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
  listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
  22:52:03.732841 IP 10.240.xxx.xxx &gt; 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 &gt; 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 1, length 64
  22:52:04.740726 IP 10.240.xxx.xxx &gt; 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 &gt; 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 2, length 64
  22:52:05.748690 IP 10.240.xxx.xxx &gt; 216.66.xxx.xxx: IP6 2001:470:xxxx:xxxx::2 &gt; 2001:470:xxxx:xxxx::1: ICMP6, echo request, seq 3, length 64  
  </code></pre>
  
  <p>I changed the endpoint temporarily to an address where I can run tcpdump, and confirmed that packets are not arriving at the destination.  I even tried NAT myself in case GCE wasn't doing this for 6in4 packets, but no luck (<code>iptables -t nat -A POSTROUTING -p ipv6 -j SNAT --to-source 130.211.xxx.xxx</code>).</p>
  
  <p>Has anyone gotten a 6in4 tunnel to work on a GCE VM?  Is there some magic setting I missed somewhere?</p>