[bitfolk] IPv6 VPN with tinc

I tried following the guide at https://tools.bitfolk.com/wiki/IPv6/VPNs to set up a tunnel between my VPS and a machine at home (both running Debian testing), the plan being to give out v6 addresses to the machines at home. I have a /56 assigned to my VPS (2001:ba8:1f1:a00/56), and the VPS's eth0 has 2001:ba8:1f1:a00::2 assigned to it as well as an IP from the original /64 (2001:ba8:1f1:f07a::2). The IPv6 on there seems to work fine (I can ping ipv6.google.com etc.). The two ends are assigned IPs in 2001:ba8:1f1:a01::/64 - the VPS has ::1, the machine at the other end ::2. When I start tinc on both machines, I can ping the other endpoint IPs (i.e. ::2 from the VPS, ::1 from the machine at home) as well as the VPS's other IPs (i.e. I can ping the IP from the original /64 from home), but the machine at home can't get to anything beyond the VPS. On the VPS (ra): tinc.conf Name = ra ConnectTo = camulus Interface = camulus Device = /dev/net/tun DeviceType = tap BindToAddress = 85.119.82.221 Port = 655 Mode = switch tinc-up #!/bin/sh ip address add 2001:ba8:1f1:a01::1/64 dev $INTERFACE ip link set dev $INTERFACE promisc on ip link set dev $INTERFACE up exit 0 On camulus: Name = camulus ConnectTo = ra Interface = ra Device = /dev/net/tun DeviceType = tap BindToAddress = 192.168.1.13 Port = 655 Mode = switch tinc-up #!/bin/sh ip -6 addr add 2001:ba8:1f1:a01::2/64 dev $INTERFACE ip link set dev $INTERFACE promisc on ip link set dev $INTERFACE up ip -6 route add default via 2001:ba8:1f1:a01::1 dev $INTERFACE exit 0 On both: hosts/camulus Port 655 -----BEGIN RSA PUBLIC KEY----- -----END RSA PUBLIC KEY----- hosts/ra Address = 85.119.82.221 Port = 655 -----BEGIN RSA PUBLIC KEY----- -----END RSA PUBLIC KEY----- What am I missing? Cheers, Stuart