diff --git a/miniupnpd/pcpserver.c b/miniupnpd/pcpserver.c
index baba945..cfcafb5 100644
--- a/miniupnpd/pcpserver.c
+++ b/miniupnpd/pcpserver.c
@@ -1049,13 +1049,29 @@ static int ValidatePCPMsg(pcp_info_t *pcp_msg_info)
 		return 0;
 	}
 
-	/* RFC 6887, section 8.2: MUST return address mismatch if NAT
-	 * in middle. (XXX n/a in thirdparty case) */
-	if (memcmp(pcp_msg_info->int_ip,
-		   &pcp_msg_info->sender_ip,
-		   sizeof(pcp_msg_info->sender_ip)) != 0) {
-		pcp_msg_info->result_code = PCP_ERR_ADDRESS_MISMATCH;
-		return 0;
+	if (pcp_msg_info->thirdp_ip) {
+		if (!GETFLAG(PCP_ALLOWTHIRDPARTYMASK)) {
+			pcp_msg_info->result_code = PCP_ERR_UNSUPP_OPTION;
+			return 0;
+		}
+
+		/* RFC687, section 13.1 - if sender ip == THIRD_PARTY,
+		 * it's an error. */
+		if (memcmp(pcp_msg_info->thirdp_ip,
+			   &pcp_msg_info->sender_ip,
+			   sizeof(pcp_msg_info->sender_ip)) == 0) {
+			pcp_msg_info->result_code = PCP_ERR_MALFORMED_REQUEST;
+			return 0;
+		}
+	} else {
+		/* RFC 6887, section 8.2: MUST return address mismatch if NAT
+		 * in middle. */
+		if (memcmp(pcp_msg_info->int_ip,
+			   &pcp_msg_info->sender_ip,
+			   sizeof(pcp_msg_info->sender_ip)) != 0) {
+			pcp_msg_info->result_code = PCP_ERR_ADDRESS_MISMATCH;
+			return 0;
+		}
 	}
 
 	/* protocol zero means 'all protocols' : internal port MUST be zero */