to be more clear I should write it that way:
Internet > sys-net (which has no net qube, because it’s connected to Internet) > pi-hole (which is connected to it’s net qube sys-net) > sys-firewall (which is connected to it’s net qube pi-hole) > ChocolateVM (which is connected to it’s net qube sys-firewall…
in short → internet > sys-net > pi-hole > sys-firewall > ChocolatVM > Qubes OS user