+ # some of our hosts (e.g. villa and lobos) do ipv6 via tunnels (proto 41)
+ # this requires we allow proto ipv6 to work in all cases.
+ # without this, ipv6 connectivity only works once the host itself
+ # created some ipv6 connectivity to some place.
+ proto ipv6 ACCEPT;