diff --git a/ipn/ipnlocal/local.go b/ipn/ipnlocal/local.go
index bf88221ab..fc7b997bc 100644
--- a/ipn/ipnlocal/local.go
+++ b/ipn/ipnlocal/local.go
@@ -5882,12 +5882,11 @@ func (b *LocalBackend) setTCPPortsInterceptedFromNetmapAndPrefsLocked(prefs ipn.
 	b.reloadServeConfigLocked(prefs)
 	if b.serveConfig.Valid() {
 		servePorts := make([]uint16, 0, 3)
-		b.serveConfig.RangeOverTCPs(func(port uint16, _ ipn.TCPPortHandlerView) bool {
+		for port := range b.serveConfig.TCPs() {
 			if port > 0 {
 				servePorts = append(servePorts, uint16(port))
 			}
-			return true
-		})
+		}
 		handlePorts = append(handlePorts, servePorts...)
 
 		b.setServeProxyHandlersLocked()
@@ -5915,7 +5914,7 @@ func (b *LocalBackend) setServeProxyHandlersLocked() {
 		return
 	}
 	var backends map[string]bool
-	b.serveConfig.RangeOverWebs(func(_ ipn.HostPort, conf ipn.WebServerConfigView) (cont bool) {
+	for _, conf := range b.serveConfig.Webs() {
 		for _, h := range conf.Handlers().All() {
 			backend := h.Proxy()
 			if backend == "" {
@@ -5937,8 +5936,7 @@ func (b *LocalBackend) setServeProxyHandlersLocked() {
 			}
 			b.serveProxyHandlers.Store(backend, p)
 		}
-		return true
-	})
+	}
 
 	// Clean up handlers for proxy backends that are no longer present
 	// in configuration.
diff --git a/ipn/serve.go b/ipn/serve.go
index 32e74e688..e82279db8 100644
--- a/ipn/serve.go
+++ b/ipn/serve.go
@@ -6,6 +6,7 @@
 import (
 	"errors"
 	"fmt"
+	"iter"
 	"net"
 	"net/netip"
 	"net/url"
@@ -564,39 +565,42 @@ func ExpandProxyTargetValue(target string, supportedSchemes []string, defaultSch
 	return u.String(), nil
 }
 
-// RangeOverTCPs ranges over both background and foreground TCPs.
-// If the returned bool from the given f is false, then this function stops
-// iterating immediately and does not check other foreground configs.
-func (v ServeConfigView) RangeOverTCPs(f func(port uint16, _ TCPPortHandlerView) bool) {
-	for k, v := range v.TCP().All() {
-		if !f(k, v) {
-			return
-		}
-	}
-	for _, conf := range v.Foreground().All() {
-		for k, v := range conf.TCP().All() {
-			if !f(k, v) {
+// TCPs returns an iterator over both background and foreground TCP
+// listeners.
+//
+// The key is the port number.
+func (v ServeConfigView) TCPs() iter.Seq2[uint16, TCPPortHandlerView] {
+	return func(yield func(uint16, TCPPortHandlerView) bool) {
+		for k, v := range v.TCP().All() {
+			if !yield(k, v) {
 				return
 			}
 		}
+		for _, conf := range v.Foreground().All() {
+			for k, v := range conf.TCP().All() {
+				if !yield(k, v) {
+					return
+				}
+			}
+		}
 	}
 }
 
-// RangeOverWebs ranges over both background and foreground Webs.
-// If the returned bool from the given f is false, then this function stops
-// iterating immediately and does not check other foreground configs.
-func (v ServeConfigView) RangeOverWebs(f func(HostPort, WebServerConfigView) bool) {
-	for k, v := range v.Web().All() {
-		if !f(k, v) {
-			return
-		}
-	}
-	for _, conf := range v.Foreground().All() {
-		for k, v := range conf.Web().All() {
-			if !f(k, v) {
+// Webs returns an iterator over both background and foreground Web configurations.
+func (v ServeConfigView) Webs() iter.Seq2[HostPort, WebServerConfigView] {
+	return func(yield func(HostPort, WebServerConfigView) bool) {
+		for k, v := range v.Web().All() {
+			if !yield(k, v) {
 				return
 			}
 		}
+		for _, conf := range v.Foreground().All() {
+			for k, v := range conf.Web().All() {
+				if !yield(k, v) {
+					return
+				}
+			}
+		}
 	}
 }