But SPR (Secure Programmable Router) by Supernetworks approaches this differently. It gives every single device its own isolated /30 subnet with a unique WPA3 passphrase. No device can talk to another unless you explicitly allow it. And it runs on a Raspberry Pi 4 or 5, or their pre-built Compute Board ($399.99).

I spent an afternoon digging into SPR v1.1.7 (released today, July 7, 2026), deployed it on a Pi 5, and walked through the React UI. Here’s what makes it interesting—and where it falls short.

What Makes SPR Super Different

Consumer routers from TP-Link, Eero, or Nest WiFi create one flat network — one SSID, one password, every device in the same broadcast domain. If one device gets compromised, the attacker can scan the entire LAN.

SPR flips that model entirely.

Still, the Multi-PSK WPA3 feature alone sets SPR apart. Each device gets its own unique WiFi passphrase. So if a guest leaves or a device is compromised, you revoke just one passphrase — not the whole network. That’s something no consumer mesh system offers today.

Hands-On With SPR v1.1.7

Setting up SPR on a Raspberry Pi 5 was straightforward. The README documents two paths: building from source with ./build_docker_compose.sh --load or pulling prebuilt Docker images. I took the prebuilt route — docker-compose pull && docker-compose up -d — and it was running in about 15 minutes.

Now, the React UI is clean and responsive. You add devices, assign policies, and watch traffic in real time. The per-device DNS controls are granular: you can set ad-block lists per device, route specific devices through DoH, or bypass filtering for trusted services.

But here’s the honest part — SPR is not plug-and-play. If you’re used to an Eero app where you click “Add Device” and you’re done, SPR will feel like work. You need Docker. You need to understand subnets. You need to think about firewall rules in terms of device groups and policies. This is a tool for people who know what they’re doing.

Built-In WireGuard VPN

SPR includes WireGuard natively for remote access to your home network — no separate VPN server needed. Each remote device gets a WireGuard public key as its identity, the same zero-trust model as WiFi clients. For a deeper look at WireGuard itself, our setup guide covers the manual approach.

Where SPR Super Falls Short

Still, SPR has real limitations worth noting:

First, the learning curve. The documentation is thorough but assumes networking knowledge. If you don’t know what a /30 subnet is, you’ll struggle.

Second, the paid tier. SPR PLUS unlocks mesh backhaul, event-triggered rules, and DNAT rewriting. But the pricing isn’t visible on GitHub — you have to visit their website. For an open-source project, that’s frustrating.

Third, the Pi 5’s built-in WiFi isn’t great for this. You’ll want a dedicated access point or their $399 Compute Board — which puts it in Firewalla Purple territory ($359). And Firewalla’s app is much more polished.

Bottom Line

SPR Super is one of the only open-source router OS options that delivers per-device WPA3 isolation out of the box. If you’re willing to invest the time — and you care about device-level zero-trust on your home network — it’s a genuinely different approach. No consumer router does what SPR does.

But it’s not for everyone. If you want something that works after a 5-minute setup, stick with Eero, TP-Link Deco, or Firewalla. Still, SPR serves the self-hosted crowd well — people who run Docker on a Pi, manage their own DNS (check out our NetBird self-hosted WireGuard mesh review for a similar DIY approach), and understand why a flat home network is a privacy risk.

To try it, you’ll need a Raspberry Pi 5 ($55-80) and a high-endurance SD card — both available on Amazon if you’re buying Pi hardware. No cloud subscription required.