So the SixXS Tunnel Robot tells you your IPv6 tunnel is down, but you can't seem to find anything wrong?

Apparently this problem is Linux specific, some people even say it's Debian specific.
It is caused by iptables doing NAT (Network Address Translation) or iptables doing Connection Tracking.

When you bring up your tunnel, you initiate a connection from your IPv4 address to the IPv4 address of your IPv6-POP. This connection is then used to send encapsulated IPv6 packets over. In theory, this connection will never be closed, unless you bring down your tunnel interface. This also means that the remote end is allowed to send packets to your local end without first having to negotiate a new connection.

Now, what happens when you run NAT (Network Address Translation) or Connection Tracking, is that iptables will remember what connections were active and automatically allow packets that are related to one of those active connections to come back in.

As long as you keep sending IPv6 packets to IPv6 hosts on the internet, IPv4 packets will flow through the IPv4 connection with your IPv6-POP and iptables will keep tracking (remembering) the connection and thus allowing packets the other way around to come back in. The SixXS tunnel robot pings your tunnel, packet gets accepted, your router responds, and all is well.

If you don't send any IPv6 packets to IPv6 hosts for a certain amount of time (see sysctl -a | grep "conntrack") the connection will 'time out' in the Connection Tracking tables and iptables will forget about it, and start rejecting packets that actually belong to the active, yet idle, connection between you and your IPv6-POP. SixXS tunnel robot pings your tunnel, packet gets rejected, no reply is sent, your tunnel seems down.

So, all we have to do is tell iptables to stop tracking connections between you and your IPv6-POP's IPv4 address, and instead just accept them. That way it doesn't matter how long the connection has been idle, the ping packets would always be accepted.

To accomplish this, put these lines somewhere early in your iptables script, at least before any Connection Tracking rules and/or NAT rules:

    iptables -A INPUT  --proto 41 -s <endpoint-ipv4>/32 -d <youripv4>/32      -j ACCEPT
    iptables -A OUTPUT --proto 41 -s <youripv4>/32      -d <endpoint-ipv4>/32 -j ACCEPT

This will allow all IPv6 traffic between you and your IPv6-POP in both directions without it being tracked.
If you also have NAT (Network Address Translation) in your network setup, you'd also have to specify that protocol 41 (IPv6 in IP encapsulation) should not be masqueraded (and thus not tracked) by specifying '--proto ! 41' somewhere in the masquerading rule:

    iptables -t nat -A POSTROUTING -s 192.168.0.0/16 --proto ! 41 -o ppp0 -j MASQUERADE

After all, there is no need to masquerade IPv6, since you'll have as many IPv6 IP adresses as you have hairs on your head! :)