Create a secure process to open a firewall port on a server (on
demand) start a listening server, and ultimately close the firewall
Your goal seems flawed for many reasons. This would not be scalable in an enterprise environment due to the lack of available ports that could blossom on a heavy day of visits/work. You would always have to have multiple firewalls in round-robin behind load balancing. Further, your firewall would need all types of ASICs to make it work making it a pretty expensive firewall. On the DoS side of the equation, you're wrong. Sending 10gbps to any socket opened or not will kill a 1gb connection regardless of how many drops/rejects (which are not a good idea), that you envision making. The BETTER logic would be to configure your router to only accept connections from trusted sources, and block all of the remainder.
I won't even get into the statistics of client side exploits, phishing, and other attacks your firewall won't stop. But at the onset, your goal doesn't do much but add a lot of overhead and complexities that will likely hinder you in the future.
Your implementation is also flawed and based on security through obscurity (changing the firewall port). You would be better off using standard port with rules in place on that port with two factor authentication. You're assuming an attacker won't find the port. While you may minimize the low hanging fruit, eventually someone will find the port, and although they may not be able to do anything, the can certainly perform a resource exhaustion (DoS) against your firewall. That in turn depending on its placement could outright block all traffic. "Root" access is a horrible idea especially at the egress point, and you're assuming a firewall of this nature would be run perhaps Linux? While it may be, most ASIC based firewalls that need to do heavy hauling tend to consist of JeOS (Just Enough Operating System. But should you insist to go the Linux route, this is what sudo is for.
I didn't bother with assumptions, there is no need to.