Here are some tweaks to try:

# Assuming that tun1 is the IPv4-in-IPv6 client, and eth0 is the AFTR's
# Internet connection:
$ iptables -A FORWARD -i tun1 -o eth0 -s 172.0.0.0/24 -m
  conntrack --ctstate NEW -j ACCEPT

$ iptables -A FORWARD -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT

# Again, assuming eth0 is the AFTR's Internet connection
$ iptables -A POSTROUTING -t nat -o eth0 -j MASQUERADE