Trying to Learn

I try to learn how to acces a LAN friend. He gave me his router ID and that's all.

I know I can for example do a DNS spoofing by changing DNS info from the DHCP config of his router.

Is there something else?

I try to open all the ports but since there is no service behind that's doesn't seem to work, they all appeard as "filtered".

Can I acces his LAN through the router? I mean without accessing devices inside the LAN?

The SSH is disabled by defaut by the firmware so there is no way I can access it.

Could I access it by creating static routes pointing to my public IP or something like that?

Thanks