Mike,
Using Fing on iPhone with the VPN connected:
- try pinging 172.217.0.174 (that's the IP for google.com, at least that's what it is for me in my location).
- and/or 98.139.183.24 (yahoo.com)
- and/or 192.150.16.117 (adobe.com).
If the pings are successful, that indicates that the ERL is receiving the ICMP packets from the iPhone through the VPN, and routing them out to the internet, like it's supposed to.
- if the pings fail, it's not a DNS issue, since DNS wasn't involved.
Then try pinging the same servers, but by name (google.com, yahoo.com, adobe.com).
After entering the domain name, hit return. If DNS lookups are working correctly, Fing will display the corresponding IP addresses. Then tap Ping host and see if the pings will succeed.
If DNS is not working over the VPN, Fing won't display the corresponding IPs. And of course the pings will fail.
- that would suggest there's something wrong with DNS resolution.
However, if your iDevices can't access local LAN devices either, it doesn't sound like a DNS issue (unless you're addressing them by name instead of by the local IP).
Another test you could try is using Safari on iPhone (with VPN connected) to connect to 172.217.0.174 or 192.150.16.117. Since this specfies the endpoints by IP, no DNS lookup is required.
I also find it puzzling that the Windows machine works but the iOS devices don't. There's gotta be some obscure difference in the way they are configured. You need to get some assistance from someone here who has more EdgeRouter expertise than I have. (I'm using an ERX with v 1.9.0. Maybe there's some quirk in the ERL that makes it function differently...)