diff --git a/src/ssh.rs b/src/ssh.rs
index 7a5f150..d6aa3de 100644
--- a/src/ssh.rs
+++ b/src/ssh.rs
@@ -167,8 +167,11 @@ impl Handler {
 #[command(version, about, long_about = None)]
 struct Args {
     /// Make all tunnels public by default instead of private
-    #[arg(short, long)]
+    #[arg(long, group = "access")]
     public: bool,
+
+    #[arg(long, group = "access")]
+    protected: bool,
 }
 
 impl russh::server::Handler for Handler {
@@ -244,6 +247,11 @@ impl russh::server::Handler for Handler {
                     self.set_access_all(TunnelAccess::Public).await;
                     self.redraw().await?;
                 }
+                if args.protected {
+                    trace!("Making tunnels protected");
+                    self.set_access_all(TunnelAccess::Protected).await;
+                    self.redraw().await?;
+                }
             }
             Err(err) => {
                 trace!("Sending help message and disconnecting");