I want to set up a private match with a password so only me and him can play. Can he just look in the server list and find my game, or what?

"I want to set up a private match with a passwor" privat match ok when you make a privat match its not in the server list XD your friend need to make

 

connect (your ip) if it doesnt work use hamachi

You need to forward port 28960 on your router for your friend to be able to join your private match, unless you're on the same local network (on the same house).

unless you're on the same local network (on the same house).

interesting deduction, detective. sadly, neither is a network restricted to one 'house', nor is a 'house' restricted to one network.

If he can't join 2 people on a match, he surely doesn't have an "out of the standard" local network configuration.

Elementary, my dear Watson.