diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index bc67e1ccb..b420cdf80 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -4463,7 +4463,7 @@ func (b *LocalBackend) CheckIPForwarding() error {
 	}
 
 	// TODO: let the caller pass in the ranges.
-	warn, err := netutil.CheckIPForwarding(tsaddr.ExitRoutes(), nil)
+	warn, err := netutil.CheckIPForwarding(tsaddr.ExitRoutes(), b.sys.NetMon.Get().InterfaceState())
 	if err != nil {
 		return err
 	}
diff --git a/ipn/ipnlocal/peerapi.go b/ipn/ipnlocal/peerapi.go
index 40314da38..93d2ed2ad 100644
--- a/ipn/ipnlocal/peerapi.go
+++ b/ipn/ipnlocal/peerapi.go
@@ -1282,8 +1282,8 @@ func (h *peerAPIHandler) handleWakeOnLAN(w http.ResponseWriter, r *http.Request)
 		return
 	}
 	var password []byte // TODO(bradfitz): support?
-	st, err := interfaces.GetState()
-	if err != nil {
+	st := h.ps.b.sys.NetMon.Get().InterfaceState()
+	if st == nil {
 		http.Error(w, "failed to get interfaces state", http.StatusInternalServerError)
 		return
 	}
diff --git a/net/interfaces/interfaces.go b/net/interfaces/interfaces.go
index e9e21eabc..792385317 100644
--- a/net/interfaces/interfaces.go
+++ b/net/interfaces/interfaces.go
@@ -506,6 +506,8 @@ var getPAC func() string
 // GetState returns the state of all the current machine's network interfaces.
 //
 // It does not set the returned State.IsExpensive. The caller can populate that.
+//
+// Deprecated: use netmon.Monitor.InterfaceState instead.
 func GetState() (*State, error) {
 	s := &State{
 		InterfaceIPs: make(map[string][]netip.Prefix),
diff --git a/net/netcheck/netcheck.go b/net/netcheck/netcheck.go
index 676c5e695..fcccfe99e 100644
--- a/net/netcheck/netcheck.go
+++ b/net/netcheck/netcheck.go
@@ -166,6 +166,8 @@ type Client struct {
 	// NetMon optionally provides a netmon.Monitor to use to get the current
 	// (cached) network interface.
 	// If nil, the interface will be looked up dynamically.
+	// TODO(bradfitz): make NetMon required. As of 2023-08-01, it basically always is
+	// present anyway.
 	NetMon *netmon.Monitor
 
 	// TimeNow, if non-nil, is used instead of time.Now.
diff --git a/net/netutil/ip_forward.go b/net/netutil/ip_forward.go
index 9b015c754..afcea4e5a 100644
--- a/net/netutil/ip_forward.go
+++ b/net/netutil/ip_forward.go
@@ -51,7 +51,7 @@ func protocolsRequiredForForwarding(routes []netip.Prefix, state *interfaces.Sta
 
 // CheckIPForwarding reports whether IP forwarding is enabled correctly
 // for subnet routing and exit node functionality on any interface.
-// The state param can be nil, in which case interfaces.GetState is used.
+// The state param must not be nil.
 // The routes should only be advertised routes, and should not contain the
 // nodes Tailscale IPs.
 // It returns an error if it is unable to determine if IP forwarding is enabled.
@@ -65,14 +65,10 @@ func CheckIPForwarding(routes []netip.Prefix, state *interfaces.State) (warn, er
 		}
 		return nil, nil
 	}
-	const kbLink = "\nSee https://tailscale.com/s/ip-forwarding"
 	if state == nil {
-		var err error
-		state, err = interfaces.GetState()
-		if err != nil {
-			return nil, err
-		}
+		return nil, fmt.Errorf("Couldn't check system's IP forwarding configuration; no link state")
 	}
+	const kbLink = "\nSee https://tailscale.com/s/ip-forwarding"
 	wantV4, wantV6 := protocolsRequiredForForwarding(routes, state)
 	if !wantV4 && !wantV6 {
 		return nil, nil