diff --git a/include/openthread/ip6.h b/include/openthread/ip6.h
index 7ba0fe548..7e0db0d98 100644
--- a/include/openthread/ip6.h
+++ b/include/openthread/ip6.h
@@ -418,8 +418,9 @@ otError otIp6Send(otInstance *aInstance, otMessage *aMessage);
  * @param[in]  aInstance A pointer to an OpenThread instance.
  * @param[in]  aPort     The port value.
  *
- * @retval OT_ERROR_NONE     The port was successfully added to the allowed unsecure port list.
- * @retval OT_ERROR_NO_BUFS  The unsecure port list is full.
+ * @retval OT_ERROR_NONE         The port was successfully added to the allowed unsecure port list.
+ * @retval OT_ERROR_INVALID_ARGS The port is invalid (value 0 is reserved for internal use).
+ * @retval OT_ERROR_NO_BUFS      The unsecure port list is full.
  *
  */
 otError otIp6AddUnsecurePort(otInstance *aInstance, uint16_t aPort);
@@ -434,8 +435,9 @@ otError otIp6AddUnsecurePort(otInstance *aInstance, uint16_t aPort);
  * @param[in]  aInstance A pointer to an OpenThread instance.
  * @param[in]  aPort     The port value.
  *
- * @retval OT_ERROR_NONE       The port was successfully removed from the allowed unsecure port list.
- * @retval OT_ERROR_NOT_FOUND  The port was not found in the unsecure port list.
+ * @retval OT_ERROR_NONE         The port was successfully removed from the allowed unsecure port list.
+ * @retval OT_ERROR_INVALID_ARGS The port is invalid (value 0 is reserved for internal use).
+ * @retval OT_ERROR_NOT_FOUND    The port was not found in the unsecure port list.
  *
  */
 otError otIp6RemoveUnsecurePort(otInstance *aInstance, uint16_t aPort);
diff --git a/src/core/net/ip6_filter.cpp b/src/core/net/ip6_filter.cpp
index 93ccaa3c2..0139ea497 100644
--- a/src/core/net/ip6_filter.cpp
+++ b/src/core/net/ip6_filter.cpp
@@ -124,6 +124,8 @@ otError Filter::AddUnsecurePort(uint16_t aPort)
 {
     otError error = OT_ERROR_NONE;
 
+    VerifyOrExit(aPort != 0, error = OT_ERROR_INVALID_ARGS);
+
     for (int i = 0; i < kMaxUnsecurePorts; i++)
     {
         if (mUnsecurePorts[i] == aPort)
@@ -152,6 +154,8 @@ otError Filter::RemoveUnsecurePort(uint16_t aPort)
 {
     otError error = OT_ERROR_NONE;
 
+    VerifyOrExit(aPort != 0, error = OT_ERROR_INVALID_ARGS);
+
     for (int i = 0; i < kMaxUnsecurePorts; i++)
     {
         if (mUnsecurePorts[i] == aPort)
diff --git a/src/core/net/ip6_filter.hpp b/src/core/net/ip6_filter.hpp
index d3fea8560..d1c82eb1b 100644
--- a/src/core/net/ip6_filter.hpp
+++ b/src/core/net/ip6_filter.hpp
@@ -80,8 +80,9 @@ public:
      *
      * @param[in]  aPort  The port value.
      *
-     * @retval OT_ERROR_NONE     The port was successfully added to the allowed unsecure port list.
-     * @retval OT_ERROR_NO_BUFS  The unsecure port list is full.
+     * @retval OT_ERROR_NONE         The port was successfully added to the allowed unsecure port list.
+     * @retval OT_ERROR_INVALID_ARGS The port is invalid (value 0 is reserved for internal use).
+     * @retval OT_ERROR_NO_BUFS      The unsecure port list is full.
      *
      */
     otError AddUnsecurePort(uint16_t aPort);
@@ -91,8 +92,9 @@ public:
      *
      * @param[in]  aPort  The port value.
      *
-     * @retval OT_ERROR_NONE       The port was successfully removed from the allowed unsecure port list.
-     * @retval OT_ERROR_NOT_FOUND  The port was not found in the unsecure port list.
+     * @retval OT_ERROR_NONE         The port was successfully removed from the allowed unsecure port list.
+     * @retval OT_ERROR_INVALID_ARGS The port is invalid (value 0 is reserved for internal use).
+     * @retval OT_ERROR_NOT_FOUND    The port was not found in the unsecure port list.
      *
      */
     otError RemoveUnsecurePort(uint16_t aPort);