I am not 100% sure about changing the port. It might best to use port-redirection (i.e. forward 0.0.0.0:1234 to localhost:2087 and drop all packets from the outside net to ports 2086/7).
To achieve the UA protection of your WHM, I would use the string matching in IPTables Here's it in use (for a different purpose): http://spamcleaner.org/en/misc/w00tw00t.html
I would set a deny by default rule, then allow anyone who has the string with the
User-Agent that you require. While IP tables will match the entire packet (i.e. it won't specifically look at the
User-Agent field of the request), if you make the string specific enough, this should not be a problem.