Since this kernel lacks some modules related to netfilter for ipv6, ip6tables doesn't work correctly. See below:
-- 2.6.32-4-pve:/lib/modules/2.6.32-4-pve/kernel/net/ipv6/netfilter
ip6_queue.ko ip6t_REJECT.ko ip6t_frag.ko ip6t_mh.ko ip6table_mangle.ko
ip6_tables.ko ip6t_ah.ko ip6t_hbh.ko ip6t_rt.ko ip6table_raw.ko
ip6t_LOG.ko ip6t_eui64.ko ip6t_ipv6header.ko ip6table_filter.ko
-- 2.6.32-5-amd64 (Debian/squeeze):/lib/modules/2.6.32-5-amd64/kernel/net/ipv6/netfilter/
ip6_queue.ko ip6t_ah.ko ip6t_ipv6header.ko ip6table_mangle.ko
ip6_tables.ko ip6t_eui64.ko ip6t_mh.ko ip6table_raw.ko
ip6t_LOG.ko ip6t_frag.ko ip6t_rt.ko ip6table_security.ko
ip6t_REJECT.ko ip6t_hbh.ko ip6table_filter.ko nf_conntrack_ipv6.ko
--
The kernel 2.6.32-4-pve is build without ip6table_security.ko nor nf_conntrack_ipv6.ko. Please update the kernel ASAP.