Homebrew puts the OpenVPN binary in sbin, not your PATH

The install finishes, brew says openvpn is there, and the shell answers command not found. The binary exists; it sits in a directory the shell was never told about. Homebrew links daemon-style binaries into the prefix sbin directory, and a default macOS PATH usually includes the bin directory and not the sbin one. Nothing is broken, and no reinstall will change it.

Four checks confirm the mechanism before you edit any shell file.

What the formula actually installs

The openvpn formula builds a command-line daemon, so its executable lands under sbin rather than bin. Homebrew then links that binary into the prefix sbin directory, which is why "$(brew --prefix)/sbin/openvpn" --version works while a bare invocation does not. The versioned Cellar directory holds a copy as well, and putting that path in a startup file is how a machine stays pinned to an old build after an upgrade.

The prefix symlink is the stable path. The Cellar path is an implementation detail with a version number in it.

Ask Homebrew, not the filesystem

Start with the package manager, because it knows which installation owns the formula: command -v brew, brew --prefix, brew list --versions openvpn, brew --prefix openvpn. If the last one prints a path, the formula is present and the question is purely about resolution. If it prints nothing, the shell is looking in the wrong place for a package that was never installed, which is a different problem with a different fix.

Two Homebrew installations on one machine is where this matters most: the brew that answers is not necessarily the brew that installed.

Why the shell cannot see sbin

A login shell builds PATH from system defaults plus whatever your startup files append. Homebrew bin is commonly added and Homebrew sbin commonly is not, so every command works except the daemons. command -v openvpn returning nothing while the prefixed path returns a version is the whole diagnosis in two commands. Confirm the directory really holds the link with ls -l "$(brew --prefix)/sbin/openvpn".

A missing link is a different fault from a missing PATH entry, and only one of them is fixed by editing a shell file.

Fix the path once, in one place

For a quick test in the current shell, eval "$(brew shellenv)" sets the installation variables and prepends both directories. For a permanent arrangement, put the shellenv line in the one startup file your shell reads for the login mode you use, instead of scattering exports across bash and zsh files.

Then open a new terminal and repeat the version query, because a cached shell keeps reporting the old PATH.

Keep discovery separate from the service

Finding a binary is not the same as running a VPN service. Starting openvpn automatically adds profile, credential, privilege and lifecycle requirements that package discovery never touched. Tunnelblick also bundles its own engine, so the version you just printed may have nothing to do with the version the application uses.

Record which executable produced the version output. That one line saves an hour the next time two versions disagree.