If you connect your router to the hotels network, two things can happen:
In this case, your device behaves as a bridge to the actual network. This doesn't really add any security at all, as it just passes packages into the network. Any device connecting to your bridge effectively connects to the original hotel network.
This is more likely going to happen and probably what you are asking about. Your router creates a private network, your devices can connect to. The router controls this network which is different from the hotel's network.
Any package passed from your device
D to the router
R is treated the following way:
D looks up the destination IP and notices that it's not in its network
D sends the package to its configured gateway
R notices that the destination IP is not in a network it's directly connected to and therefore intents to send it to its gateway, the hotels router/gateway.
R runs in NAT-mode. Therefore
D's package is masqueraded before being sent.
R modifies the packages sender information to contain its own MAC and IP (IP is
R's IP in the hotel network)
- An answer to this package take the same route vice versa.
R receives it, changes the destination information to
D in its private network and passes it to
The security benefit is, that none of the devices outside of your routers private network can see any device in it, except the router itself. While this prevents attacks targeting your devices directly, your router can still be attacked. In addition, this does NOT encrypt your traffic by default. Your router still sends your data through the hotel's network, just like your device gave it to your router.
Using a VPN encrypts everything you send, even while it travels through the hotel's network until it reaches the VPN gateway. If this is your objective, your router alone is not sufficient.
Your options are either using a VPN, encrypted Proxy connection (SOCKS for example) or strictly enforcing HTTPS (or another encryption) on every connection you use (which is rather tricky).