1. I can join my server with client.connect localhost:28015 but my friend can't.
     
  2. This means that your server is not port-forwarded. There are over one-hundred threads on this topic and they are very easy to find.
     
  3. Of course your friends can't join with "client.connect localhost:28015". That's for your machine only. If you're on the same network (connected to the same wifi, lan etc) they should replace localhost with your ipv4. If you want them to connect via internet you should port forward and they should use your public ip.
     
  4. how to port forward?
     
  5. Localhost points to the machine that you are on. For your friends, it will point to the machine that they are on.
    You friends need your public IP address and port, 123.4.5.678:28015 - Google "what is my ip" or "How to IP" <sigh>.

    If they can't access with the publicIP you'll need to port forward on your router, and maybe open the port in your server computer's firewall.

    You want to forward port 28015 traffic to the local address of your server machine - 192.168.*.*...or similar.
    You can find that in your network connection settings/details.

    If they are on your local network, as Quantum says, you can just give them that local IP.
    You may still need to open the port on your machine's firewall.