Unable to reach security.debian.org through an HurricaneElectric IPv6 pipe

[fw at deneb.enyo.de (Florian Weimer)]

* Laurent CARON:

> I'm currently unable to reach security.debian.org
> (2001:8d8:2:1:6564:a62:0:2) through IPv6.
>
> donald:~# traceroute -M tcpconn -p 80 wieck.debian.org -n -6
> traceroute to wieck.debian.org (2001:8d8:2:1:6564:a62:0:2), 30 hops max, 80 byte packets

It helps if you mention your own IP address.  Using 2001:7a8:820:1::1
instead, I get this in the reverse direction (from wieck):

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1), 30 hops max, 40 byte packets
 1  vl-121.gw-dists-a.bs.ka.oneandone.net (2001:8d8:2:1::1)  1.530 ms  1.614 ms  1.709 ms
 2  te-1-2.bb-c.bs.kae.de.oneandone.net (2001:8d8:0:5::1)  1.116 ms  1.169 ms  1.104 ms
 3  te-4-2.bb-c.act.fra.de.oneandone.net (2001:8d8:0:2::11)  3.479 ms  3.540 ms  3.591 ms
 4  te-1-1.bb-c.nkf.ams.nl.oneandone.net (2001:8d8:0:2::9)  10.139 ms  10.200 ms  10.247 ms
 5  te-1-2.bb-c.the.lon.gb.oneandone.net (2001:8d8:0:2::5)  17.257 ms  17.321 ms  17.377 ms
 6  linx.he.net (2001:7f8:4::1b1b:1)  17.281 ms  16.399 ms  16.456 ms
 7  gige-g0-1.tserv17.lon1.ipv6.he.net (2001:470:0:a3::2)  16.546 ms  16.562 ms  16.512 ms
 8  * * *
[and nothing more]

A traceroute from 2001:14b0:200:6::4 looks similar, despite taking a
different entry point into HE:

traceroute to 2001:7a8:820:1::1 (2001:7a8:820:1::1) from 2001:14b0:200:6::4, 30 hops max, 24 byte packets
 1  2001:14b0:200:6::3 (2001:14b0:200:6::3)  27.324 ms  29.593 ms  26.593 ms
 2  2a01:1e8:2:3::1 (2a01:1e8:2:3::1)  26.827 ms  26.772 ms *
 3  2a01:1e8:2:4::1 (2a01:1e8:2:4::1)  30.685 ms  30.684 ms  30.767 ms
 4  de-cix.he.net (2001:7f8::1b1b:0:1)  31.821 ms  35.31 ms  33.465 ms
 5  gige-g0-1.tserv18.fra1.ipv6.he.net (2001:470:0:a5::2)  33.738 ms  33.368 ms  30.792 ms
 6  * * *

So this seems to be something beyound our (that is, Debian's) control,
assuming that 2001:7a8:820:1::1 is as good as the IP address you've
actually been assigned.