[varenc]

It likely relies on the travel router cloning the MAC address of your phone or whatever you use to authenticate. That way the hotel just thinks the travel router is your phone.

[dawnerd]

It’s also (I’d hope) modifying the ttl as that’s used to detect travel routers.