diff --git a/dashboard/backend/main.py b/dashboard/backend/main.py
index b123541..40f43b6 100644
--- a/dashboard/backend/main.py
+++ b/dashboard/backend/main.py
@@ -116,7 +116,20 @@ async def health():
 
 @app.get("/api/client-ip")
 async def client_ip(request: Request):
-    return {"ip": request.client.host}
+    ip = request.client.host
+    if ip.startswith("192.168.31."):
+        return {"ip": ip, "lan": True}
+    # Tailscale client — check if Mac is reachable on LAN
+    if ip.startswith("100."):
+        try:
+            proc = await asyncio.create_subprocess_exec(
+                "ping", "-c", "1", "-W", "1", "192.168.31.2",
+                stdout=asyncio.subprocess.DEVNULL, stderr=asyncio.subprocess.DEVNULL,
+            )
+            return {"ip": ip, "lan": await asyncio.wait_for(proc.wait(), 2) == 0}
+        except Exception:
+            pass
+    return {"ip": ip, "lan": False}
 
 # Public auth endpoints
 app.include_router(auth.router, prefix="/api/auth", tags=["auth"])
diff --git a/dashboard/frontend/src/components/Sidebar.svelte b/dashboard/frontend/src/components/Sidebar.svelte
index ac8b1a3..8306a4a 100644
--- a/dashboard/frontend/src/components/Sidebar.svelte
+++ b/dashboard/frontend/src/components/Sidebar.svelte
@@ -14,7 +14,7 @@
 
   if (typeof window !== "undefined") {
     fetch("/api/client-ip").then(r => r.json()).then(d => {
-      if (d.ip?.startsWith("192.168.31.")) lanReachable = true;
+      if (d.lan) lanReachable = true;
     }).catch(() => {});
   }