digraph G {
    node [ shape=box, fontcolor="#ffffff", color="#40a9e3", style="filled"  ]
#    rankdir="LR"

    subgraph cluster_internet {
        label="Internet/Upstream"

        ipv6internet [ label="The IPv6 Internet" shape=oval ];
        ipv4internet [ label="The IPv4 Internet" shape=oval ];
        ipv6vpn [ label="IPv6VPN.ch\nIPv6 via wireguard" shape=oval ];

        upstream [ label="Upstream" shape=oval ];
        router [ label="Existing router" ];
    }

    upstream->ipv6internet [ label="Might connect to" ]
    upstream->ipv4internet [ style=dashed label="Connects to" ]
    ipv6vpn->ipv6internet [ label="Provides access to" ]
    router->upstream

    subgraph cluster_lan {
        label="IPv4 (only) LAN"

        lan [ label="Your LAN" ];
        lanclients [ label="Clients in the lan" ]
    }

    lanclients->lan [ label="Connected to" ];

    subgraph cluster_pib {
        label="The Pro IPv6 Box (PIB)"

        pib [ label="The PIB" color="#ee1100" ];
        pibwan [ label="The PIB (WAN, eth0)" color="#ee1100" ];
        piblan [ label="The PIB (LAN, eth1, eth2)" color="#ee1100" ];
    }

    pib->ipv6vpn [ label="Get IPv6 connectivity\nvia LAN or WAN" ]
    pibwan -> router [ style=dashed label="Acquires IPv4\nand/or IPv6" ];
    pibwan -> lan [ style=dashed label="Acquires IPv4\nand/or IPv6" ];
    pib->{pibwan,piblan}
    piblan -> lan [ label="Distributes IPv6" ];

    lanclients->lan [ label="Get IPv6 addresses from PIB" ]
    lan->router [ style=dashed label="LAN upstream" ]

    ipv6internet->lanclients [
        label="SSH, HTTP, HTTPS\nports are open" ]
}