What firewall settings should I add to my (Linux) 6to4 tunnel to prevent harmful IP address spoofing?
An answer you aren't going to like is, it is very hard to secure against spoofing when you cannot know what addresses are valid to accept.
6to4 takes an IPv6 address that is routed to a translator 6to4 box, which then routes it back to your IPv4 address. Other than checking to ensure that the incoming address is yours, there's not a lot you can do in terms of anti-spoof filtering.
However, once you get the packet in, you should still continue to apply standard firewall rules to it. It will still be a TCP stream or UDP packet once it hits your box, and a good place to start there would be whatever filtering you're doing on the IPv4 side.