Support split-tunneling by homebrew symlink on macOS

[andreavaccari]

Is it a bug?

• I know this is an issue with the app, and contacting Mullvad support is not relevant.

I have checked if others have reported this already

• I have checked the issue tracker to see if others have reported similar issues.

Current Behavior

I have rclone installed via Homebrew on macOS 26.3. Its binary lives at:

/opt/homebrew/Cellar/rclone/1.73.3/bin/rclone

Homebrew also creates a stable symlink at /opt/homebrew/bin/rclone, which does not change between version updates.

When I add rclone to the split-tunneling exclusion list through the Mullvad app, the resulting config in /etc/mullvad-vpn/settings.json resolves the symlink and stores the real path:

{
  "split_tunnel": {
    "enable_exclusions": true,
    "apps": [
      "/opt/homebrew/Cellar/rclone/1.73.3/bin/rclone"
    ]
  }
}

Because the path includes the version number, the exclusion silently breaks every time rclone is updated to a newer version.

Expected Behavior

The split-tunneling configuration should preserve the symlink path as provided by the user (/opt/homebrew/bin/rclone) rather than resolving it to the underlying target. This would keep the exclusion working across package updates — a common need for any Homebrew-managed binary.

Steps to Reproduce

1. Install any CLI tool via Homebrew (e.g. brew install rclone).
2. In the Mullvad app, add /opt/homebrew/bin/rclone to the split-tunneling exclusion list.
3. Observe that settings.json contains the resolved Cellar path, not the symlink.
4. Update the tool (brew upgrade rclone) and confirm the exclusion no longer applies.

Failure Logs

Operating system version

26.3 (25D125)

Mullvad VPN app version

2026.1

Additional Information

Little Snitch has a similar problem and solves it by allowing wildcards, e.g. /opt/homebrew/Cellar/rclone/*/bin/rclone

[MarkusPettersson98]

That's interesting. Will look into if there are any technical reasons for this, or if it's just an oversight. Thanks for the detailed report!