diff --git a/src/core/net/ip6_filter.cpp b/src/core/net/ip6_filter.cpp
index 86a3e5420..3bfa4f251 100644
--- a/src/core/net/ip6_filter.cpp
+++ b/src/core/net/ip6_filter.cpp
@@ -50,12 +50,6 @@ namespace Ip6 {
 
 RegisterLogModule("Ip6Filter");
 
-Filter::Filter(Instance &aInstance)
-    : InstanceLocator(aInstance)
-{
-    memset(mUnsecurePorts, 0, sizeof(mUnsecurePorts));
-}
-
 bool Filter::Accept(Message &aMessage) const
 {
     bool        rval = false;
@@ -70,7 +64,6 @@ bool Filter::Accept(Message &aMessage) const
         ExitNow(rval = true);
     }
 
-    // Read IPv6 header
     SuccessOrExit(aMessage.Read(0, ip6));
 
     // Allow only link-local unicast or multicast
@@ -85,9 +78,7 @@ bool Filter::Accept(Message &aMessage) const
     switch (ip6.GetNextHeader())
     {
     case kProtoUdp:
-        // Read the UDP header and get the dst port
         SuccessOrExit(aMessage.Read(sizeof(ip6), udp));
-
         dstport = udp.GetDestinationPort();
 
         // Allow MLE traffic
@@ -107,11 +98,8 @@ bool Filter::Accept(Message &aMessage) const
         break;
 
     case kProtoTcp:
-        // Read the TCP header and get the dst port
         SuccessOrExit(aMessage.Read(sizeof(ip6), tcp));
-
         dstport = tcp.GetDestinationPort();
-
         break;
 
     default:
@@ -120,111 +108,37 @@ bool Filter::Accept(Message &aMessage) const
     }
 
     // Check against allowed unsecure port list
-    for (uint16_t unsecurePort : mUnsecurePorts)
-    {
-        if (unsecurePort != 0 && unsecurePort == dstport)
-        {
-            ExitNow(rval = true);
-        }
-    }
+    rval = mUnsecurePorts.Contains(dstport);
 
 exit:
     return rval;
 }
 
-Error Filter::AddUnsecurePort(uint16_t aPort)
+Error Filter::UpdateUnsecurePorts(Action aAction, uint16_t aPort)
 {
-    Error error = kErrorNone;
+    Error     error = kErrorNone;
+    uint16_t *entry;
 
     VerifyOrExit(aPort != 0, error = kErrorInvalidArgs);
 
-    for (uint16_t unsecurePort : mUnsecurePorts)
+    entry = mUnsecurePorts.Find(aPort);
+
+    if (aAction == kAdd)
     {
-        if (unsecurePort == aPort)
-        {
-            ExitNow();
-        }
+        VerifyOrExit(entry == nullptr);
+        SuccessOrExit(error = mUnsecurePorts.PushBack(aPort));
+    }
+    else
+    {
+        VerifyOrExit(entry != nullptr, error = kErrorNotFound);
+        mUnsecurePorts.Remove(*entry);
     }
 
-    for (uint16_t &unsecurePort : mUnsecurePorts)
-    {
-        if (unsecurePort == 0)
-        {
-            unsecurePort = aPort;
-            LogInfo("Added unsecure port %d", aPort);
-            ExitNow();
-        }
-    }
-
-    ExitNow(error = kErrorNoBufs);
+    LogInfo("%s unsecure port %d", (aAction == kAdd) ? "Added" : "Removed", aPort);
 
 exit:
     return error;
 }
 
-Error Filter::RemoveUnsecurePort(uint16_t aPort)
-{
-    Error error = kErrorNone;
-
-    VerifyOrExit(aPort != 0, error = kErrorInvalidArgs);
-
-    for (int i = 0; i < kMaxUnsecurePorts; i++)
-    {
-        if (mUnsecurePorts[i] == aPort)
-        {
-            // Shift all of the ports higher than this
-            // port down.
-            for (; i < kMaxUnsecurePorts - 1; i++)
-            {
-                mUnsecurePorts[i] = mUnsecurePorts[i + 1];
-            }
-
-            // Clear the last port entry.
-            mUnsecurePorts[i] = 0;
-            LogInfo("Removed unsecure port %d", aPort);
-            ExitNow();
-        }
-    }
-
-    ExitNow(error = kErrorNotFound);
-
-exit:
-    return error;
-}
-
-bool Filter::IsUnsecurePort(uint16_t aPort)
-{
-    bool found = false;
-
-    for (uint16_t unsecurePort : mUnsecurePorts)
-    {
-        if (unsecurePort == aPort)
-        {
-            found = true;
-            break;
-        }
-    }
-    return found;
-}
-
-void Filter::RemoveAllUnsecurePorts(void)
-{
-    memset(mUnsecurePorts, 0, sizeof(mUnsecurePorts));
-}
-
-const uint16_t *Filter::GetUnsecurePorts(uint8_t &aNumEntries) const
-{
-    // Count the number of unsecure ports.
-    for (aNumEntries = 0; aNumEntries < kMaxUnsecurePorts; aNumEntries++)
-    {
-        if (mUnsecurePorts[aNumEntries] == 0)
-        {
-            break;
-        }
-    }
-
-    return mUnsecurePorts;
-}
-
 } // namespace Ip6
 } // namespace ot
diff --git a/src/core/net/ip6_filter.hpp b/src/core/net/ip6_filter.hpp
index 86bdc4cf3..664aa0ed1 100644
--- a/src/core/net/ip6_filter.hpp
+++ b/src/core/net/ip6_filter.hpp
@@ -36,6 +36,7 @@
 
 #include "openthread-core-config.h"
 
+#include "common/array.hpp"
 #include "common/locator.hpp"
 #include "common/message.hpp"
 #include "common/non_copyable.hpp"
@@ -66,7 +67,10 @@ public:
      * @param[in]  aInstance  A reference to the OpenThread instance.
      *
      */
-    explicit Filter(Instance &aInstance);
+    explicit Filter(Instance &aInstance)
+        : InstanceLocator(aInstance)
+    {
+    }
 
     /**
      * This method indicates whether or not the IPv6 datagram passes the filter.
@@ -89,7 +93,7 @@ public:
      * @retval kErrorNoBufs       The unsecure port list is full.
      *
      */
-    Error AddUnsecurePort(uint16_t aPort);
+    Error AddUnsecurePort(uint16_t aPort) { return UpdateUnsecurePorts(kAdd, aPort); }
 
     /**
      * This method removes a port from the allowed unsecure port list.
@@ -101,7 +105,7 @@ public:
      * @retval kErrorNotFound     The port was not found in the unsecure port list.
      *
      */
-    Error RemoveUnsecurePort(uint16_t aPort);
+    Error RemoveUnsecurePort(uint16_t aPort) { return UpdateUnsecurePorts(kRemove, aPort); }
 
     /**
      * This method checks whether a port is in the unsecure port list.
@@ -111,13 +115,13 @@ public:
      * @returns Whether the given port is in the unsecure port list.
      *
      */
-    bool IsUnsecurePort(uint16_t aPort);
+    bool IsUnsecurePort(uint16_t aPort) { return mUnsecurePorts.Contains(aPort); }
 
     /**
      * This method removes all ports from the allowed unsecure port list.
      *
      */
-    void RemoveAllUnsecurePorts(void);
+    void RemoveAllUnsecurePorts(void) { mUnsecurePorts.Clear(); }
 
     /**
      * This method returns a pointer to the unsecure port list.
@@ -129,12 +133,25 @@ public:
      * @returns A pointer to the unsecure port list.
      *
      */
-    const uint16_t *GetUnsecurePorts(uint8_t &aNumEntries) const;
+    const uint16_t *GetUnsecurePorts(uint8_t &aNumEntries) const
+    {
+        aNumEntries = mUnsecurePorts.GetLength();
+
+        return &mUnsecurePorts[0];
+    }
 
 private:
     static constexpr uint16_t kMaxUnsecurePorts = 2;
 
-    uint16_t mUnsecurePorts[kMaxUnsecurePorts];
+    enum Action : uint8_t
+    {
+        kAdd,
+        kRemove,
+    };
+
+    Error UpdateUnsecurePorts(Action aAction, uint16_t aPort);
+
+    Array<uint16_t, kMaxUnsecurePorts> mUnsecurePorts;
 };
 
 } // namespace Ip6