diff --git a/lapv5.c b/lapv5.c
index 80a2533..8925c9f 100644
--- a/lapv5.c
+++ b/lapv5.c
@@ -469,7 +469,8 @@ void lapv5_instance_free(struct lapv5_instance *li)
  * while the last octet (before msg->tail) points to the last FCS octet. */
 int lapv5ef_rx(struct v5x_link *link, struct msgb *msg)
 {
-	struct lapv5_instance *li;
+	struct lapv5_instance *li = NULL;
+	struct v5x_user_port *v5up = NULL;
 	uint16_t efaddr, efaddr_enc;
 	bool is_isdn;
 	int error;
@@ -528,7 +529,16 @@ int lapv5ef_rx(struct v5x_link *link, struct msgb *msg)
 			return -EINVAL;
 		}
 		/* relay function for LAPD of user ports */
-		/* TODO */
+		v5up = v5x_user_port_find(link->interface, efaddr, true);
+		if (!v5up) {
+			LOGP(DV5EF, LOGL_ERROR, "No ISDN user port instance for EFaddr %d created.\n", efaddr);
+			msgb_free(msg);
+			return -EINVAL;
+		}
+		LOGP(DV5EF, LOGL_DEBUG, "Recevied frame for EFaddr %d: %s\n", efaddr, osmo_hexdump(msg->data, msg->len));
+		ph_socket_tx_msg(&v5up->ph_socket, 3, PH_PRIM_DATA_IND, msg->data, msg->len);
+		msgb_free(msg);
+		return 0;
 	}
 
 	if (!li) {
@@ -541,3 +551,18 @@ int lapv5ef_rx(struct v5x_link *link, struct msgb *msg)
 
 	return 0;
 }
+
+int lapv5ef_tx(struct v5x_user_port *v5up, struct msgb *msg)
+{
+	uint16_t efaddr = v5up->nr, efaddr_enc;
+
+	/* relay function for LAPD of user ports */
+	LOGP(DV5EF, LOGL_DEBUG, "Sending frame for EFaddr %d: %s\n", efaddr, osmo_hexdump(msg->data, msg->len));
+	msg->l2h = msgb_push(msg, 2);
+	efaddr_enc = v51_l3_addr_enc(efaddr, 1);
+	msg->l2h[0] = efaddr_enc >> 8;
+	msg->l2h[1] = efaddr_enc;
+	ph_data_req_hack(msg, NULL);
+
+	return 0;
+}
diff --git a/lapv5.h b/lapv5.h
index 612e0a4..48a6cbd 100644
--- a/lapv5.h
+++ b/lapv5.h
@@ -34,3 +34,4 @@ struct lapv5_instance *lapv5_instance_alloc(int network_side,
 	const struct lapd_profile *profile, const char *name);
 
 int lapv5ef_rx(struct v5x_link *link, struct msgb *msg);
+int lapv5ef_tx(struct v5x_user_port *v5up, struct msgb *msg);