It looks as though firewalls aren't as granular as I thought - at least not the ones I'm looking at. I've ended up allowing all TCP packets out to that site. Oh well.