How to Fix Parsec P2P Latency Issues When Using Cato Networks?

The Problem

Apps like Parsec try to establish a direct Peer-to-Peer (P2P) connection between two clients using UDP to reduce latency. If they go through the Cato Cloud (Socket -> PoP -> Internet -> Client), the latency increases. They need to bypass the cloud and go straight out the local ISP (Local Breakout).

However, by default, the Cato Socket might NAT the traffic in a way that breaks the P2P handshake (Symmetric NAT).

The Solution: UDP Direct Breakout Rule

You need to force this specific UDP traffic to exit the Socket directly without Cato processing.

1. Identify the Ports:

   • Parsec usually uses UDP 8000-8010 and TCP 443.

2. Configure Network Rule (Local Breakout):

   • Go to Network > Network Rules.

   • New Rule.

   • Action: Bypass (or "Off-Cloud").

   • Service/Port: Custom Service (UDP 8000-8010).

   • Source: Your "Designers/Editors" VLAN.

   • Destination: Any (Internet).

3. The "NAT" Trick:

   • Ensure the Socket WAN interface is set to "Cone NAT" if possible (check ISP settings), or ensure the rule allows STUN traffic.

4. Verification:

   • In the Parsec app, check the console. It should show a "Direct" connection, not "Relay".

   • In Cato Events, you should stop seeing logs for this traffic (because it’s bypassing the engine).

FAQ

1) Why does Parsec experience high latency when routed through Cato Networks?

Parsec relies on direct UDP peer-to-peer connections. When traffic is routed through the Cato Cloud, additional hops increase latency and can break the P2P handshake.

2) What is UDP direct breakout in Cato Networks?

UDP direct breakout forces specific UDP traffic to bypass Cato inspection and exit locally through the ISP, preserving low-latency peer-to-peer connectivity.

3) Which ports does Parsec typically use for P2P connections?

Parsec commonly uses UDP ports 8000–8010 for real-time P2P traffic and TCP 443 for control and fallback connectivity.

4) How does NAT type affect Parsec P2P connectivity on Cato?

Symmetric NAT can break P2P negotiation. Using Cone NAT or allowing STUN traffic improves successful direct connections between Parsec clients.

5) How can admins verify Parsec traffic is bypassing Cato correctly?

In Parsec, the connection should show “Direct” instead of “Relay,” and Cato Events logs should no longer display traffic for the bypassed UDP ports.