diff --git a/vars/local_vars_big.yml b/vars/local_vars_big.yml
index 8b680a2cc..575461c35 100644
--- a/vars/local_vars_big.yml
+++ b/vars/local_vars_big.yml
@@ -62,13 +62,6 @@ py_captive_portal_install: True
 py_captive_portal_enabled: True
 # In a pinch, disable it by running: systemctl disable py-captive-portal
 
-# Stages 3 & 4 must be run (using iiab-install or runrole) if changing these:
-squid_install: True
-squid_enabled: True
-
-dansguardian_install: True
-dansguardian_enabled: True
-
 # Unmaintained as of October 2017: https://github.com/iiab/iiab/pull/382
 # wondershaper_install: False
 # wondershaper_enabled: False
@@ -88,8 +81,17 @@ openvpn_handle: ""
 # The following seems necessary on CentOS:
 # openvpn_cron_enabled: True
 
+
 # 2-COMMON
 
+# Auto-enabled for "debuntu" OS's, in roles/2-common/tasks/packages.yml#L35-L36
+# in 0-init/defaults/main.yml AND 0-init/tasks/main.yml :
+exFAT_enabled: True
+
+# /usr/libexec/iiab-startup.sh is much like autoexec.bat & /etc/rc.local
+# It's put in place by 2-common/tasks/iiab-startup.yml at the end of Stage 2.
+
+
 # 3-BASE-SERVER
 
 # Make this False to disable http://box/common/services/power_off.php button:
@@ -104,7 +106,16 @@ apache_high_php_limits: False
 
 # 4-SERVER-OPTIONS
 
-# roles/network runs here (MANY SETTINGS ABOVE)
+# dnsmasq, named, dhcpd basics are installed here...in preparation for
+# the full roles/network = iiab-network that runs after 9-LOCAL-ADDONS
+
+# Squid
+squid_install: False
+squid_enabled: False
+
+# DansGuardian
+dansguardian_install: False
+dansguardian_enabled: False
 
 # PostgreSQL - auto-installed by Moodle and/or Pathagar - no need to touch!
 postgresql_install: False