This should be cleared up now. Go ahead and test things again.

Maybe I fooled you by using the term 'router'.
It is an usual OpenBSD box installed on a normal amd64 arch. that does NAT for my SOHO network. It's not a router device itself.

Its a router because it routes traffic. It doesn't really matter what the hardware and software are. If it routes traffic, its a router.

As has been said before, you don't need to fiddle with NAT for ipv6. With your tunnel you were given a "Routed /64". This is the subnet/prefix you will want to use on your internal LAN. Just configure your OpenBSD machine to run radvd configured with the "Routed /64" prefix on the internal interface, and ensure that the machine will forward ipv6 properly. Then all your internal systems should autoconfigure themselves with an address within that prefix and be able to talk ipv6 to the world.

The whois test does not accept rwhois output, which is what you see in the examples you provided. It only accepts whois output from RIRs.

You will need to setup one computer to act as a router for the rest of your LAN. It will route between the tunnel /64 (the Client IPv6 address) and the routed /64 subnet (which you can use however you like).

You will be able to validate your address once you reach Sage.

You will have to email dnsadmin@he.net.

We've kicked the server. Try changing it again.

Asking them is always a good option, but good luck with Verizon Tier 1 support.

Just try setting up a tunnel and see if it works.

You've got two levels of NAT going on there, with one level being a possible CGN. I am rather doubtful you will be able to setup a tunnel through all of that.

But if you want to try, when you enter the commands on your computer, replace the 189.* IP with 10.0.0.100.

I can't ping that endpoint from here. Are you NAT'd behind the router? I would check the router first to ensure that it is allowing ICMP.

You might try WinMTR: http://winmtr.net/

Probably, yes, if its not using privacy extensions.

Your system used DAD (duplicate address detection). It saw that the address was already in use, and chose a different one.

iface eth0 inet6 static
         accept_ra 0
         autoconf 0

Or you can put this in /etc/sysctl.conf:

net.ipv6.conf.eth0.autoconf = 0
net.ipv6.conf.eth0.accept_ra = 0

Tunnelbroker now supports both 16-bit and 32-bit ASNs, so you should have no problem using a 32-bit ASN to setup a BGP tunnel.