diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 71d1b3e22..954dae0dd 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -127,11 +127,6 @@ iiab_gateway_enabled: False
 # Gateway mode
 iiab_lan_enabled: True
 iiab_wan_enabled: True
-# Ties in what the user populated in the GUI for static WAN IP address info:
-gui_wan: True
-gui_port: 80    # 2021-08-17: For iptables.  And #2811 dreams of HTTPS/443 ?
-# adm_cons_force_ssl: False    # Likewise: iiab-admin.yml & js-menu.yml set it.
-adm_cons_allow_downloads: False
 
 # Intended for developers: ONLY CHANGE THESE IF YOU KNOW WHAT YOU ARE DOING
 # The following 2 override the detection when not "auto"
@@ -151,6 +146,10 @@ wan_nameserver:    # wan_nameserver: 192.168.1.254 or 8.8.8.8 or 1.1.1.1
 wan_try_dhcp_before_static_ip: True   # Facilitate field updates w/ cablemodems
 # Details @ roles/network/templates/network/dhcpcd.conf.j2 for /etc/dhcpcd.conf
 
+gui_port: 80    # 2021-08-17: For iptables.  And #2811 dreams of HTTPS/443 ?
+# adm_cons_force_ssl: False    # Likewise: iiab-admin.yml & js-menu.yml set it.
+adm_cons_allow_downloads: False
+
 # Enable "campus access" to ~10 common IIAB services like Kiwix (3000), KA Lite
 # (8008) and Calibre (8010 or 8080) etc, on the WAN side of your IIAB server.
 # Only 1 of the 6 lines below should be uncommented: