diff --git a/iptables-forward.sh b/iptables-forward.sh
index 3c8a46e..d785091 100644
--- a/iptables-forward.sh
+++ b/iptables-forward.sh
@@ -15,8 +15,6 @@ on_error() {
 }
 trap 'on_error "$?" "$LINENO"' ERR
 
-require_root || exit $?
-
 # shellcheck source=lib/storage.sh
 source "${LIB_DIR}/storage.sh"
 # shellcheck source=lib/persist.sh
@@ -153,6 +151,14 @@ run_batch() {
 }
 
 main() {
+  case ${1-} in
+    --help|-h)
+      usage
+      return 0
+      ;;
+  esac
+
+  require_root || return $?
   bootstrap
 
   if (($# == 0)); then
@@ -161,9 +167,6 @@ main() {
   fi
 
   case ${1-} in
-    --help|-h)
-      usage
-      ;;
     --batch)
       shift
       run_batch "$@"
diff --git a/tests/run_all.sh b/tests/run_all.sh
index f4402f2..2b57fbd 100644
--- a/tests/run_all.sh
+++ b/tests/run_all.sh
@@ -23,6 +23,7 @@ run_test() {
 }
 
 run_test "${ROOT_DIR}/tests/test_common.sh"
+run_test "${ROOT_DIR}/tests/test_cli.sh"
 run_test "${ROOT_DIR}/tests/test_storage.sh"
 run_test "${ROOT_DIR}/tests/test_env_check.sh"
 run_test "${ROOT_DIR}/tests/test_rules_unit.sh"
diff --git a/tests/test_cli.sh b/tests/test_cli.sh
new file mode 100644
index 0000000..f3c2b0e
--- /dev/null
+++ b/tests/test_cli.sh
@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/.." && pwd)
+# shellcheck source=tests/lib/assert.sh
+source "${ROOT_DIR}/tests/lib/assert.sh"
+
+help_output=$("${ROOT_DIR}/iptables-forward.sh" --help)
+assert_contains "${help_output}" '--batch add <proto> <listen_port> <target_ip> <target_port> <ipver> [desc]' 'main script help should describe batch add'
+
+install_help=$("${ROOT_DIR}/install.sh" --help)
+assert_contains "${install_help}" '仅创建符号链接，不复制源码。' 'install help should explain symlink behavior'
+
+pass 'test_cli.sh'