diff --git a/start.sh b/start.sh
index 64424cc..07703da 100755
--- a/start.sh
+++ b/start.sh
@@ -12,14 +12,16 @@ usage() {
     echo "To start in single-port mode configured from command-line:"
     echo "${THIS} -p <port> -s <secret> -t <ad tag>"
     echo "To only allow connections with randomized protocol (dd-secrets):"
-    echo "${THIS} -d"
+    echo "${THIS} -a dd"
     echo "Parameters:"
     echo "-p <port>: port to listen on. 1-65535"
     echo "-s <secret>: proxy secret. 32 hex characters 0-9 a-f"
     echo "-t <ad tag>: promo tag that you get from @MTProxybot. 32 hex characters"
-    echo "-d: only allow 'secure' connections (with dd-secret)"
-    echo "port, secret, tag and secure mode can also be configured via environment variables:"
-    echo "MTP_PORT, MTP_SECRET, MTP_TAG, MTP_DD_ONLY"
+    echo "-a dd: only allow 'secure' connections (with dd-secret) / fake-tls connections (base64 secrets)"
+    echo "-a tls: only allow 'fake-tls' connections (base64 secrets)"
+    echo "It's ok to provide both '-a dd -a tls'."
+    echo "port, secret, tag and allowed protocols can also be configured via environment variables:"
+    echo "MTP_PORT, MTP_SECRET, MTP_TAG, MTP_DD_ONLY, MTP_TLS_ONLY"
     echo "If both command line and environment are set, command line have higher priority."
 }
 
@@ -37,7 +39,7 @@ DD_ONLY=${MTP_DD_ONLY:-""}
 TLS_ONLY=${MTP_TLS_ONLY:-""}
 
 # check command line options
-while getopts "p:s:t:dh" o; do
+while getopts "p:s:t:a:dh" o; do
     case "${o}" in
         p)
             PORT=${OPTARG}
@@ -49,9 +51,9 @@ while getopts "p:s:t:dh" o; do
             TAG=${OPTARG}
             ;;
         a)
-            if [ "${OPTARG}" -e "dd" ]; then
+            if [ "${OPTARG}" = "dd" ]; then
                 DD_ONLY="y"
-            elif [ "${OPTARG}" -eq "tls" ]; then
+            elif [ "${OPTARG}" = "tls" ]; then
                 TLS_ONLY="y"
             else
                 error "Invalid -a value: '${OPTARG}'"
@@ -70,7 +72,7 @@ done
 PROTO_ARG=""
 
 if [ -n "${DD_ONLY}" -a -n "${TLS_ONLY}" ]; then
-    PROTO_ARG="-mtproto_proxy allowed_protocols [mtp_fake_tls, mtp_secure]"
+    PROTO_ARG='-mtproto_proxy allowed_protocols [mtp_fake_tls,mtp_secure]'
 elif [ -n "${DD_ONLY}" ]; then
     PROTO_ARG='-mtproto_proxy allowed_protocols [mtp_secure]'
 elif [ -n "${TLS_ONLY}" ]; then