So does the 2k8r2 box act as your NAT router, ie is really the gateway for your network. Or is inside your network already and your just using it as the endpoint for the tunnel?
Once you tunnel the ipv6 through your gateway, then yes every device that would be using this endpoint as its ipv6 gateway would need to have a firewall on it. This is the problem with endpoint of the tunnel being inside your network.
If you endpoint the tunnel at your gateway, then its firewall could be used to filter ipv6 traffic into your network.
What device is your gateway to the public net now? Is it this 2k8r2 box? You have a public IP on one of its interfaces, and you nat that into your private network? or do you have some router before this 2k8r2 box?
So at the moment this box is behind the WNDR3700 Netgear NAT and is the tunnel endpoint. Since the Windows firewall is entirely oriented towards filtering traffic directed at that machine, rather than something like Forefront TMG which is a "real" forwarding firewall, I am currently playing around instead with setting up a Linux VM on this machine (rather than using the native Windows OS) with the idea that it goes:
HE->IPV4 NAT->Linux VM tunnel endpoint->(IP6TABLES or other IP6 firewall package with only IP6 packet forwarding turned on)-> other LAN machines.
I've got the tunnel set up and working on the VM (MS now has CentOS 6.0 support in Hyper-V), and now I'm playing around with the IPv6 firewall and forwarding config, which is an education for me because I'm not much of a Linux guy.
If I set things up that way, I think I will essentially have one router/firewall for IPv4 (the netgear) and one router/firewall for IPV6 (the Linux VM) and the fact that the tunneled packets are transparently forwarded through the IPv4 firewall without inspection doesn't seem like such a big deal/risk as long as the proper filtering is taking place between the incoming tunnel and the forwarding of those packets out to the LAN - those tunneled packets can't skirt around the tunnel endpoint inside the LAN and mess up other machines on my network, so far as I can see...
As for why I'm not just doing this all on the netgear device directly, well, as I mentioned earlier, using DD-WRT and such was turning into a somewhat painful exercise on this router, in that it was having undesirable effects on wireless signal strength. So I'm just looking for a cheap solution using my existing hardware.