Hi.

In the weekend, for my kids, I installed ubuntu server and Mojan's Bedrock Minecraft server on a spare thin client I had.
It's working perfectly so far, even though the Mojang Bedrock Edition Minecraft Server is alpha.

The kids would like their friends to be able to play on the Minecraft server also by remotely accessing it from their homes.

Could someone offer some guidance on how to do this securely?

I have a dynamic public IP address (no CG-NAT) and my router is an Ubiquiti ERL-3. I do have dynamic dns set up, although I expect a static public IP address will be required.
The ubuntu server has a static LAN ip address.

I believe I need to do the following things

i) whitelist my kids' friends' Minecraft users.
ii) put the Minecraft server on its own subnet or VLAN
iii) open up port 19132 and forward it to LAN IP address of the Minecraft server.

thank you in advance