Your ssh rule says it’s from anywhere. You want to change port 22 to 25565, and run /op username on your Minecraft server to whitelist your friends. Make sure your whitelist flag is turned on with your server config.
Instead of allowing traffic over your port from anywhere, you can specify your friend’s external IP.
You can test it out by running ‘telnet <ip> <port>’ to check if the port is open. This is best done from another network.