Well, had anybody made a succeeful setup to HE-TunnelBroker with a PPTP connection? I tried but it seems does not work:
PPP0 is the PPTP virtual interface
root@crc:/etc# tcpdump -i ppp0
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on ppp0, link-type LINUX_SLL (Linux cooked), capture size 96 bytes
20:14:49.208189 IP bearice-2.tserv3.fmt2.dyn.he.net > tserv3.fmt2.ipv6.he.net: IP6 bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo request, seq 1, length 64
20:14:49.509491 IP tserv3.fmt2.ipv6.he.net > bearice-2.tserv3.fmt2.dyn.he.net: IP6 bearice-2.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo reply, seq 1, length 64
20:14:50.208404 IP bearice-2.tserv3.fmt2.dyn.he.net > tserv3.fmt2.ipv6.he.net: IP6 bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo request, seq 2, length 64
20:14:50.509896 IP tserv3.fmt2.ipv6.he.net > bearice-2.tserv3.fmt2.dyn.he.net: IP6 bearice-2.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo reply, seq 2, length 64
However:
root@crc:/etc# tcpdump -i he-ipv6
tcpdump: WARNING: he-ipv6: no IPv4 address assigned
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on he-ipv6, link-type RAW (Raw IP), capture size 96 bytes
20:16:08.041850 IP6 bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo request, seq 1, length 64
20:16:09.050482 IP6 bearice-2-pt.tunnel.tserv3.fmt2.ipv6.he.net > bearice-2.tunnel.tserv3.fmt2.ipv6.he.net: ICMP6, echo request, seq 2, length 64
It seems that reply packets are droped.

Of course i did not have any iptable filters.