You have to start IRI using the --remote flag. and don't forget to disable some API calls. For example:
java -jar iri.jar -p 14700 -r 14700 -n "udp://neighbor1:14265" --remote-limit-api "removeNeighbors, addNeighbors, interruptAttachingToTangle, attachToTangle, getNeighbors" --remote
See here for other IRI startup flags
Exposing your API to the public has risks, but is not necessarily a problem. Some of the risks include a higher likelihood of a Denial of Service attack, additional attempts to port-scan your IP (for example, to see if you have an open SSH port as well), etc.
Additionally, if you do expose the API to the public, you will want to limit which API calls are ...
There is a really good introduction on iota.partners
I would use the standard ports. This makes it way easier for neighbors.
UDP_RECEIVER_PORT = 14600
TCP_RECEIVER_PORT = 15600
But yes, security is a important topic. Since you have to add the neighbors by hand, you can also add a firewall in front of these ports. So that only these neighbors can talk ...
Using a non-standard port would make it more difficult for a potential attacker to find full iota nodes. But it would take more than just finding those nodes in order to wage an attack on them. Nodes have to add each other in both directions before they will accept transactions from one another. Full nodes do not expose their API port by default, so full ...