No local DNS when connected to SSL VPN

With "local ACL" you allow access to the firewalls DNS-service.

You need an additional firewall rule to access DNS on 10.0.0.4. Do you have such a rule?

With "local ACL" you allow access to the firewalls DNS-service.

You need an additional firewall rule to access DNS on 10.0.0.4. Do you have such a rule?

Like this?

Doesn't seem to change anything so maybe I did this wrong?

this allows access to the DNS-service of the firewall.
If you use the firewall-IP for DNS, this may work.

If you wish to use an different DNS-server, you need a firewall-rule (not a local ACL) to allow this access.

Create a LOG-and-DROP rule at the end of your firewall rule set and check for dropped packets.

The first part of what you said makes sense...

for the second part... Is that rule not already created?

Yes, these rule should allow access to the PiHole.
if you enable logging, you can check this.