oidentd and port 113
"oidentd" won't authenticate a proper mask without opening port 113 on whatever firewall application you're using to manage connections. This is especially obvious if you use ZNC and you desire to allow such identification authentication.
Open up port 113 through your firewall. Here's an example with IPTables:
iptables -t filter -I INPUT -p 113 -j ACCEPT iptables -t filter -I OUTPUT -p 113 -j ACCEPT
IPv6 TUN issue
Unblocking Protocol 41 generally works to bypass firewall restrictions for IPv6 tunnel traffic. Sometimes this is not the case with CSF, even if you specify in the TCP_IN section port "41". Instead, the IPv6 connection will generally hang after a short period of time when establishing a connection to the firewall.
Simply go to /etc/csf/csfpre.sh (or create it if it doesn't already exist), and add the following:
# Protocol 41 for Hurricane Electric Tunnelbroker iptables -t filter -I INPUT -p 41 -j ACCEPT iptables -t filter -I OUTPUT -p 41 -j ACCEPT
CSF will run this script at the end of applying all other rules. It simply applies the policy which protocol 41 is whitelisted inbound/outbound in its entirety.
Even if you're not running CSF, the general rule applies in this instance.