diff --git a/client/iface/wgproxy/bind/proxy.go b/client/iface/wgproxy/bind/proxy.go
index 5bf670e07..be6f3806e 100644
--- a/client/iface/wgproxy/bind/proxy.go
+++ b/client/iface/wgproxy/bind/proxy.go
@@ -203,6 +203,9 @@ func fakeAddress(peerAddress *net.UDPAddr) (*netip.AddrPort, error) {
 	if peerAddress == nil {
 		return nil, fmt.Errorf("nil peer address")
 	}
+	if peerAddress.Port < 0 || peerAddress.Port > 65535 {
+		return nil, fmt.Errorf("invalid UDP port: %d", peerAddress.Port)
+	}
 
 	addr, ok := netip.AddrFromSlice(peerAddress.IP)
 	if !ok {