I've found the problem (on my end at least). I have a transparent proxy (squid) running on my firewall (pfSense). I needed to check "Do not forward traffic to Private Address Space (RFC 1918) destinations." Once I did, it works fine.
The problem is that the UI makes browser-side connections to ws://your-freenas-fqdn/websocket. And if those connections go through a proxy, it doesn't work for some reason. My guess would be that websocket doesn't talk HTTP.
(edit: Turns out that websockets
do talk HTTP, but
any proxy that they traverse must support websockets. I haven't verified yet, but it seems that Squid 3.5.26 does not, though I haven't yet ruled out that squidclamav could be affecting.)
If you aren't running a proxy, it is probably something else interfering with those connections. Some sort of security filter, most likely.
As a first step in debugging, try opening the interface in Chrome / Firefox, hit F12, select the Network tab, refresh the page, and have a look at the Request / Response headers for the websocket connections.