# SPR (Secure Programmable Router) by Supernetworks

> SPR is an open-source, self-hosted WiFi router that gives every device its own isolated network automatically — per-device VLANs, unique WiFi passphrases, and a default-deny firewall. No cloud dependency, no telemetry. Built in Go + React, runs in Docker.

SPR is engineered with security in mind at every step. Its defense-in-depth architecture layers per-device layer-2 isolation, default-deny firewalling, containerized services, and narrow service and privilege boundaries so protection does not depend on a single control. SPR minimizes exposed services and attack surface, and SPR-authored backend components use memory-safe languages—primarily Go—where practical.

SPR replaces a traditional consumer router. Each device that joins WiFi gets its own passphrase, its own VLAN, and its own GTK, so devices cannot see or attack each other on layer 2. Connectivity between devices is allowed only through explicit firewall policy. Wired and Wireguard VPN clients are isolated the same way. The same defenses also block the four attack vectors disclosed in NDSS 2026 against WiFi client isolation (shared GTK abuse, gateway bouncing, port stealing via MAC spoofing, broadcast reflection).

The product hardware is a Raspberry Pi CM5–based PoE+ WiFi 7 router ($399.99). The software is open source and also runs on Raspberry Pi 4/5, Banana Pi, and any Linux box with Docker.

## Project & source

- [GitHub: spr-networks/super](https://github.com/spr-networks/super): main monorepo (Go services, React UI, hostapd config, container compose)
- [Latest release & prebuilt SPR image](https://github.com/spr-networks/super/releases/latest): `spr-debian.img.xz` for Raspberry Pi
- [Discord community](https://discord.gg/EUjTKJPPAX)

## Documentation

- [Documentation home (intro)](https://www.supernetworks.org/pages/docs/intro): what SPR is and the security model
- [Setup guides index](https://www.supernetworks.org/pages/docs/setup_guides/setup_run_spr): Docker / bare metal / Pi flows
- [Web UI install walkthrough](https://www.supernetworks.org/pages/docs/setup_guides/install): step-by-step browser setup for the CM5 board
- [Raspberry Pi 4/5 setup](https://www.supernetworks.org/pages/docs/setup_guides/pi4b)
- [Virtual SPR (VPN-only mode)](https://www.supernetworks.org/pages/docs/setup_guides/virtual_spr)
- [Command-Line Setup TUI](https://www.supernetworks.org/pages/docs/setup_guides/setup_run_spr#command-line-setup-tui): connect with `ssh ubuntu@192.168.2.1` or `ssh ubuntu@spr.local` (default password: `ubuntu`), then run `sudo /home/spr/super/base/scripts/spr-setup-tui.sh`
- [User Manual / guides](https://www.supernetworks.org/pages/docs/guides/dns): devices, groups, firewall, DNS, links, mesh, alerts
- [FAQ](https://www.supernetworks.org/pages/docs/faq)

## API

- [Full API reference (Redoc)](https://www.supernetworks.org/pages/api/0): rendered from `spr-openapi.yaml`
- [OpenAPI spec source](https://github.com/spr-networks/super/blob/main/api/spr-openapi.yaml)
- Default base URL on the device: `http://spr.local` (or the LAN IP, default `192.168.2.1`)
- Auth: HTTP Basic, Bearer token, or JWT-with-OTP for privileged operations. Tokens are managed at `/tokens`. See `configs/auth/auth_users.json`, `configs/auth/auth_tokens.json`, `configs/auth/otp_settings.json`.

## Hardware

- [SPR WiFi 7 PoE+ Router (CM5) — order page](https://www.supernetworks.org/compute-board.html): $399.99, MT7996 3x3 802.11be, 2.5 Gbps Ethernet
- [CM5 Compute Board article](https://www.supernetworks.org/pages/articles/hardware/spr-cm5-compute-board)
- [Raspberry Pi 4 starter kit article](https://www.supernetworks.org/pages/articles/hardware/spr-pi4-wifi-vpn-starter-kit)

## Articles & research

- [Articles overview](https://www.supernetworks.org/pages/articles): hardware and integrations
- [Blog](https://www.supernetworks.org/pages/blog): security research, CVE writeups, deep dives
- [AirSnitch / NDSS 2026 — breaking WiFi client isolation](https://www.supernetworks.org/pages/blog/airsnitch-breaking-wifi-client-isolation)

## Optional

- [Full distilled context (llms-full.txt)](https://www.supernetworks.org/llms-full.txt): single-file summary of SPR concepts, API, and common tasks, optimized for LLM context windows