@massy1 OP was correct. Firefox ESR 45 does need a socks-proxy unless a new preference is set in about:config. Bit of a head scratcher…
Introduce a new preference (network.dns.blockDotOnion) to allow blocking .onion at the DNS level
(insert usual disclaimers regarding firefox/iceweasel usage)