JUNOS Software Release [11.1R2.3] If I do a tcpdump on the server inside I get the following: 19:15:02.559203 IP6 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816 > 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www: S 3498304462:3498304462(0) win 5760 <mss 1380,sackOK,timestamp 529550252 0,nop,wscale 7> 19:15:02.559222 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253197943 529550252,nop,wscale 7> 19:15:05.562793 IP6 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816 > 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www: S 3498304462:3498304462(0) win 5760 <mss 1380,sackOK,timestamp 529550552 0,nop,wscale 7> 19:15:05.562808 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253198694 529550252,nop,wscale 7> 19:15:06.556490 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253198943 529550252,nop,wscale 7> 19:15:11.561059 IP6 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816 > 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www: S 3498304462:3498304462(0) win 5760 <mss 1380,sackOK,timestamp 529551152 0,nop,wscale 7> 19:15:11.561076 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253200194 529550252,nop,wscale 7> 19:15:12.756489 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253200493 529550252,nop,wscale 7> 19:15:24.756489 IP6 2001:470:88xx:xxxx:xxxx:xxxx:xxxx:xxxx.www > 2620:91:0:4205:xxxx:xxxx:xxxx:xxxx.40816: S 3738090997:3738090997(0) ack 3498304463 win 5712 <mss 1440,sackOK,timestamp 1253203493 529550252,nop,wscale 7> And here are some snipets from my config interfaces ( ge-0/0/0 ( unit 0 ( description Cablevision; family inet ( filter ( input fix-v6v4-tunnel; ) dhcp; ) ) ) ip-0/0/0 ( unit 0 ( description "HE IPv6 Tunnel"; tunnel ( source 69.126.xxx.xxx; destination 209.51.161.14; ) family inet6 ( address 2001:xxxx:xxxx:xxxx::2/64; ) ) ) routing-options ( rib inet6.0 ( static ( route ::/0 next-hop 2001:470:1f06:792::1; ) ) security ( forwarding-options ( family ( inet6 ( mode flow-based; ) ) ) policies ( from-zone trust to-zone untrust ( policy trust-to-untrust ( match ( source-address [ any-ipv4 any-ipv6 ]; destination-address [ any-ipv4 any-ipv6 ]; application any; ) then ( permit ( application-services ( idp; ) ) ) ) ) from-zone untrust to-zone trust ( policy allow-inbound-ipv6-http ( match ( source-address any-ipv6; destination-address SERVER-IPv6; application junos-http; ) then ( permit ( application-services ( idp; ) ) log ( session-close; ) ) ) ) ) zones ( security-zone trust ( screen untrust-screen; host-inbound-traffic ( system-services ( all; ) protocols ( all; ) ) interfaces ( vlan.0; lo0.0; ) ) security-zone untrust ( screen untrust-screen; interfaces ( ge-0/0/0.0 ( host-inbound-traffic ( system-services ( dhcp; tftp; ssh; ping; ike; ) ) ) ip-0/0/0.0 ( host-inbound-traffic ( system-services ( ssh; ) ) ) ) ) ) ) firewall ( family inet ( filter fix-v6v4-tunnel ( term one ( from ( destination-address ( 66.220.2.74/32; ) protocol 41; ) then packet-mode; ) term two ( from ( source-address ( 66.220.2.74/32; ) protocol 41; ) then packet-mode; ) term three ( then accept; ) ) ) ) #IPv6 #hosting #Server #SRX #inet6 #he.net