Whitelist Players on Your Rust Server

Rust has no whitelist switch you can turn on. Facepunch's own wiki tells owners of private servers to install a community whitelist plugin from uMod, and that is what this guide sets up. Checked against Whitelist 3.3.0 on uMod, October 2026.

What the Whitelist plugin does

The plugin turns away anyone who doesn't hold one permission, whitelist.allow. A player without it is refused when they connect, with the message "You are not whitelisted". While the Admin Excluded (true/false) setting is on (it is by default, see below), the plugin lets in anyone Oxide reports as an admin without the permission.

Version 3.3.0 has no chat or console commands of its own. You manage the list with the ordinary permission commands.

Install it

1. Open the Plugins tab. If it says Your server runs plain Rust, install Oxide or Carbon first. How to install Oxide/uMod plugins on your Rust server walks through it.
2. Don't use the Store for this one yet. At the time of writing, installing Whitelist from the Plugins tab fails with "The download didn't match the file uMod published, so it was removed."
3. Install it by hand instead. Download Whitelist.cs from the Whitelist page on uMod to your computer. Open the File Manager and Upload it into oxide/plugins on Oxide, or carbon/plugins on Carbon.
4. Load it. On Oxide, a plugin added while the server is running stays unloaded until the server restarts or you type oxide.load Whitelist in the Console tab. On Carbon it loads by itself.
5. Watch the Console tab for the plugin loading.

Add a player

Every player is identified by their SteamID64, the 17-digit number that starts with 7656. For someone who is online, users in the Console tab lists it. Rust server.cfg and admin commands covers that command.

Type this in the Console tab:

oxide.grant user 76561198123456789 whitelist.allow

On Carbon, oxide.grant prints nothing and does nothing. Use c.grant with the same arguments:

c.grant user 76561198123456789 whitelist.allow

The plugin checks the permission each time someone connects, so their next join uses it and nothing needs a restart.

To take access away, use the same arguments with oxide.revoke:

oxide.revoke user 76561198123456789 whitelist.allow

On Carbon, use c.revoke:

c.revoke user 76561198123456789 whitelist.allow

The commands take either user or group followed by a name or ID. Everyone is in the default group, so granting whitelist.allow to that group lets everybody in again. The Carbon commands c.grant and c.revoke take the same arguments.

The plugin's two settings

In the Plugins tab, switch to Installed, find Whitelist and press Config. The file has two options:

• Admin Excluded (true/false) is true by default, so admins join without the permission.
• Reset On Restart (true/false) is false by default. Turn it on and the plugin strips whitelist.allow from every user and group each time it starts up. That also happens when you reload the plugin, not only when the server restarts, so reloading with this on wipes your list. It is only useful if you want to rebuild the list every session.

Press Save, then Reload plugin to apply a change. Leave Reset On Restart (true/false) off unless you mean to clear the list.

If players are still turned away

1. The permission is misspelt. It must read exactly whitelist.allow. If the command says the permission doesn't exist, the plugin isn't loaded yet. On Oxide, type oxide.load Whitelist in the Console and check it for a compile error. On Carbon, check the Console for a compile error or run c.load Whitelist.
2. The plugin dropped out after a Rust update. Oxide needs a matching build after Facepunch's monthly update. The reinstall step is in the Oxide guide linked above.
3. A player has the wrong ID. Check the SteamID64 against the player's Steam profile before you grant it.