Personally what i do is create a separate network broadcasting from my router, then i take an IP and DMZ to allow all ports opening it up to the entire World Wide Web, this is because any network with an Open NAT that doesn't use this method poses a security risk (especially if you're on something below Windows 10)
So after i've assigned an IP for that separate network to use for the console i manually enter it in the network settings to use once connected, that way the rest of my network is off to the side secure while my console is open to use for any port it needs, clever if you think about it 😉
Hope that helps in some way, just my personal method
