FuzzCake he needs to be in-game playing with a weapon and all that to be joined, yes.
Private lobby is correct because it's private to friends only, no issue here.
The one who's hosting has to allow the connection.
Make sure to read all the guide carefully it explains everything https://plutonium.pw/docs/custom-games/
If you tried everything and it doesn't work then reply with a screenshot of the port forwarding rule on the router