diff --git a/vars/default_vars.yml b/vars/default_vars.yml
index 9d3875dac..5104c94b2 100644
--- a/vars/default_vars.yml
+++ b/vars/default_vars.yml
@@ -93,13 +93,11 @@ host_wifi_mode: g
 host_channel: 6
 hostapd_secure: False
 hostapd_password: changeme
-hostapd_install: True    # 2020-01-21: do not rely on this var for now (might be implemented in future)
+hostapd_install: True    # 2020-01-21: this var MIGHT be implemented in future.
 hostapd_enabled: True
-# Above is forcibly set to False (in roles/network/tasks/main.yml) if IIAB is
-# being WiFi-installed (run "iiab-hotspot-on" AFTER ./iiab-install completes
-# and content is downloaded, to enable the internal WiFi Access Point / AP!)
-wifi_up_down: True    # Creates a second virtual wifi adapter for WiFi upstream to internet
-                      # as well as classroom hotspot, use iiab_gateway_enabled for pass through
+wifi_up_down: True    # Creates a 2nd virtual wifi adapter for upstream WiFi
+# (e.g. to Internet) in addition to downstream WiFi (e.g. classroom hotspot).
+# You can set iiab_gateway_enabled below, to enable "passthrough" to Internet.
 
 # Gateway mode
 iiab_lan_enabled: True
@@ -125,10 +123,7 @@ ports_externally_visible: 3     # ssh + http-or-https + common IIAB services
 # /opt/iiab/iiab/roles/network/templates/gateway/iiab-gen-iptables
 # And then run: cd /opt/iiab/iiab; ./iiab-network
 
-# Gateway and Filters
-# Most all implementations use "iiab_gateway_enabled: False" within
-# local_vars.yml as they cannot afford Internet access for students
-# and teachers, and the many associated IT/support/training costs.
+# Set True if client machines should have "passthrough" access to WAN/Internet:
 iiab_gateway_enabled: False
 gw_squid_whitelist: False
 gw_block_https: False