"I don’t wanna enable UPNP, for security risks" is false plus saying "I’ve turned off almost all my security measures" right after is kinda.. funny
Opening a server has the same requirements custom games have except that it can be harder and involves more things. Hosting a server to play with friends is useless unless you need a server for a valid reason.
Security risks is not a valid reason. If anything, you're more at risk by hosting a public server more than you are by hosting a private game with your friends