No local DNS when connected to SSL VPN

With "local ACL" you allow access to the firewalls DNS-service.

You need an additional firewall rule to access DNS on 10.0.0.4. Do you have such a rule?

Like this?

Doesn't seem to change anything so maybe I did this wrong?

this allows access to the DNS-service of the firewall.
If you use the firewall-IP for DNS, this may work.

If you wish to use an different DNS-server, you need a firewall-rule (not a local ACL) to allow this access.

Create a LOG-and-DROP rule at the end of your firewall rule set and check for dropped packets.

The first part of what you said makes sense...

for the second part... Is that rule not already created?

Yes, these rule should allow access to the PiHole.
if you enable logging, you can check this.

What am I missing?

Rule 16 looks good.
.. but no hits ... :-(

You may use a DNS-test-Tool at your Phone, or connect a windows-device and use nslookup.

Check firewall log again, if you see traffic from VPN-network and Port 53.

Which Browser do you use ... possible the browser use its own DNS

Sophos firewall is the gateway for all devices in your network (pihole to?)

Rule 16 looks good.
.. but no hits ... :-(

You may use a DNS-test-Tool at your Phone, or connect a windows-device and use nslookup.

Check firewall log again, if you see traffic from VPN-network and Port 53.

Which Browser do you use ... possible the browser use its own DNS

Sophos firewall is the gateway for all devices in your network (pihole to?)