How does Network Address Translation (NAT) works on a home router? [duplicate]

I have three computers connected to a router at home. I am sure my router has only one address. When the packet arrives from computer 1, the source IP is translated to the router IP address.

Let's say both computers 1 and 2 access the same destination, this time the entry in the NAT will have the same destination address. So, how is the packet forwarded here?

When the packet arrives from destination, how are the packages distinguished between computer 1 and 2? I have a Belkin router, is it generating many source addresses. For example, dynamic NAT, each source IP is converted into a different IP address? How does it generate a pool of addresses.


The router does not only translate the source address, it also translates the source port. When two machines on the network make similar requests, for example visiting superuser.com at 198.252.206.16:80, the router translates the source ports to be unique. When the replies arrive, the router can distinguish both based on their destination ports and consults the connection table to see which one is to be forwarded to which machine. In the example of two people browsing on Super User, the connection table may look something like this:

root@FAKEROUTER:~# grep 198.252.206.16 /proc/net/ip_conntrack
tcp      6 3597 ESTABLISHED src=192.168.1.1 dst=198.252.206.16 sport=50000 dport=80 packets=8 bytes=1637 \ 
    src=198.252.206.16 dst=203.0.113.1 sport=80 dport=50000 packets=14 bytes=14747 [ASSURED] mark=20 secmark=0 use=1
tcp      6 3598 ESTABLISHED src=192.168.1.2 dst=198.252.206.16 sport=50000 dport=80 packets=8 bytes=1637 \
    src=198.252.206.16 dst=203.0.113.1 sport=80 dport=50001 packets=14 bytes=14747 [ASSURED] mark=20 secmark=0 use=1

Home routers do NAPT, Network Address and Port Translation. This means the source port is also modified, not just the source address. Usually, each connection is given a unique external port number, which is how the router recognizes the connection. It also implies that you can only have 65535 simultaneous connections no matter how many devices are behind the router.