This writeup shows in detail how to create and configure a 6in4 tunnel in pfSense. This allows you to obtain free tunneled IPv6 from Hurricane Electric right through an IPv4-only ISP. You will need one public IPv4 address to do this magic trick, but it can be the same address used for NAT. You also need to be able to configure your ISP Customer Premises Equipment (CPE, e.g. modem or router) in bridge mode. Your ISP can help with that if you don’t know how to, or don’t have the necessary CPE access. This basically means that the CPE won’t do any NAT, DHCPv4, or firewalling. That will all be done by pfSense.