digraph G {
    node [ shape=box, fontcolor="#ffffff", color="#40a9e3", style="filled"  ]

#    rankdir="LR"

    ipv6internet [ label="The IPv6 Internet" shape=oval ];
    ipv4internet [ label="The IPv4 Internet" shape=oval ];
    ipv6vpn [ label="IPv6VPN.ch\nIPv6 via wireguard" shape=oval ];

    subgraph cluster_regular {
        label="Non-enhanced mobile connection (DR)"

        subgraph cluster_onedev {
            label="One end device"
            mobile1 [ label="Mobile device" ]
        }

        subgraph cluster_multidev {
            label="Multiple end devices"
            router2 [ label="Router w/ mobile uplink" ];
            dev1 [ label="Desktop" ];
            dev2 [ label="NAS" ];
            dev3 [ label="Printer" ];
        }
    }

    subgraph cluster_enhanced {
        label="Enhanced mobile connection (DR+ungleich)"

        subgraph cluster_onedev_enhanced {
            label="One end device"
            mobile1plus [ label="Mobile device" ]
        }
        subgraph cluster_multidev_enhanced {
            label="Multiple end devices"
            router2plus [ label="Router w/ mobile uplink" ];
            dev1plus [ label="Desktop" ];
            dev2plus [ label="NAS" ];
            dev3plus [ label="Printer" ];
        }
    }

    {router2,mobile1,router2plus,mobile1plus}->ipv4internet [ label="Outgoing connections work" ]
    {router2,mobile1}->ipv6internet [ shape=dashed label="Inaccessible" ]
    {router2plus,mobile1plus}->ipv6vpn [ shape=dashed label="Establish IPv6 connection" ]
    {dev1,dev2,dev3}->router2 [ label="Connect via router" ]

    ipv4internet->mobile1 [ label="Incoming connections don't work" ]
    ipv6vpn->ipv6internet [ label="Access the IPv6 Internet" ]
    ipv6internet->{router2plus,mobile1plus,dev2plus,dev3plus,dev1plus} [ label="Access via IPv6" ]

}