Advice reqest: Security issues with port forwarding on a router?

[telemus 16]

Hello.

I hope folks here may be able to assist with some advice.

In my home network, I have a router that connects to the internet. All devices (PC, phones, and a file server, which has personal data on it) connect to the router. The router is protected by a firewall and a password - so even if a person could find its IP on the internet, it would be difficult for them to log in, without knowing the password.

The file server is protected by a password - and each user has to have a password to log in - though folders containing media files (TV shows, music) do not require passwords.

Now, one of the people here plays online games. I just discovered he as opened a port on the router to let one of his friends (and known to him personally, in real life but located miles away) to log in and play the game with him.

This was done by activating port forwarding on a specific port. No password is required: apparently, if you use the game software, know the router IP and port, the two computers can connect, through the router.

My question are these:

1. is is possible for the person to access other devices on the network, apart from the other PC used for the game? For instance, could they access the file server?

2. [Possibly answered by 1]: Is is possible for another person (not the friend) to access the home network, via the open port even if they are not using the game software?

3. If a person can get into the home network via the open port, can they access the file server?

4. Would it be safer to place the file server behind its own router?

Thank you for your time reading this and any advice you can provide.

T.