There is a tool called Firewalk that is designed to accomplish this goal. It's a bit old but since networking hasn't changed much in that time I expect it should still work.
Article, tutorial, project home page.
The whitepaper linked from the article is now at http://packetfactory.openwall.net/projects/firewalk/firewalk-final.pdf.
The general concept is that as long as there is a hop after the firewall, you can set the TTL of a packet so that it gets one hop past the firewall and expires, causing an ICMP response to be sent back to you. If you get no response, the firewall blocked the packet. If you get a response, the firewall didn't block the packet (meaning the target host must be).
There are ways this could go wrong, such as outbound ICMP messages being denied by the firewall, a different firewall may be blocking inbound or outbound traffic, general packet loss, the target host being down or there being no hops after the firewall before the target server, but if you get a positive response out of it then you know it will be accurate. The Firewalk tool has techniques to try to detect false negatives.
You can probably achieve similar results with
traceroute although you may need to fiddle with the options such as the type and size of packets that you send and you will need to send many different probes to rule out false negatives. The whitepaper uses
traceroute extensively in examples.