digraph G {
    node [ shape=box ]

    label="ungleich IPv4-over-IPv6-Tunnels"

    subgraph cluster_remote {
        label="Local site accessing remote"
        vpnbox2 [ label="ungleich VPN box\nWith Firewall" ]
        clients2 [ label="IPv4 Client device" ];
        clients3 [ label="IPv6 Client device" ];
    }


    subgraph cluster_site {
        label="Remote site with devices"
        vpnbox [ label="ungleich VPN box\nWith Firewall" ]
        clients [ label="Client devices\nin private IPv4 network\nf.i. 10.0.0.0/8" ];
    }
    vpnbox->clients [ label="IPv6 connectivity" ]

    clients2->clients [ label="Access 10.0.0.1 via 2001:db8::10.0.0.1"
    style=dashed ]
    clients2->vpnbox2 [ label="1. Access 10.0.0.1:\nlocal vpnbox translates to 2001:db8::10.0.0.1" ]
    clients3->clients [ label="Directly access 10.0.0.1 as 2001:db8::10.0.0.1"
    style=dashed ]
    clients3->vpnbox2

    vpnbox2->vpnbox [ label="2. Sends packet to 2001:db8::10.0.0.1" ]
    vpnbox->clients [ label="3. Translates 2001:db8::10.0.0.1\nto 10.0.0.1" ]


}