When hosting stuff for friends specifically, I got a firewall rule in place that only allows their duckDNS addresses to connect to whatever I'm hosting, and don't want publicly accessible.

Much safer than a Minecraft whitelist.