Your provider gives you one address that the internet can see. You have a laptop, two phones, a television, a doorbell and a printer. Every one of them wants to talk to the internet at the same time, through one address, and the answers all have to come back to the right device. NAT is how that is arranged.
One address, a switchboard behind it
NAT stands for Network Address Translation, and it does what the name says. A packet leaving your laptop carries the sender 192.168.10.25, an address that means nothing on the internet. Your router replaces that sender with its own public address before sending the packet out, and writes down what it did. When the answer comes back, the router looks up its note and sends the packet on to the laptop.
The office comparison is a switchboard. The outside world knows one telephone number. The person at the switchboard remembers which extension made which call, and puts the return call through to the right desk. Callers from outside only ever see the main number.
What a port is
An address gets a packet to the right machine. A port gets it to the right program on that machine. It is a number from 1 to 65535, written on the envelope next to the address.
A few numbers are conventions everybody follows. 80 and 443 are web traffic, 22 is SSH, 53 is DNS, 5060 is telephony. A web server listens on 443 because that is where browsers will knock.
The port your laptop uses to send from is not a convention at all. It picks a free high number for each new conversation, and that number is what makes the switchboard work: the router can tell your two phones apart because their conversations have different port numbers, even when both are talking to the same website.
What a connection is
A connection is not a wire. It is four things together: your address, your port, their address, their port. That combination is unique, and it is exactly the note the router writes down. Your router keeps a table of those notes and it is the most important table in the box after the routing table.
The note is what makes an answer recognisable. A packet arriving from outside either matches an open note, in which case it is the reply to something you asked for, or it matches nothing, in which case nobody inside asked for it. Notes for conversations that have gone quiet are thrown away after a while, which is why a connection that sits idle for an hour sometimes has to be made again.
Why outgoing needs no rule and incoming does
This is the part that explains most firewall behaviour, and it follows from the note.
When you open a website, your router writes a note and lets the reply back in because it matches. You do not have to configure anything for each website you visit, or for each app on each phone in the house.
When somebody on the internet tries to reach you out of the blue, there is no note. The router has your one public address and no idea which of your thirty devices the packet was meant for, and no reason to believe it was welcome. So it drops it.
That is a real security benefit and it is mostly an accident. NAT was invented because addresses ran out, not to protect you, but the effect is that an unasked-for packet has nowhere to go. It is also why you have to do something deliberate to run a server, a game host or a camera that you want to reach from outside: you tell the router in advance that traffic arriving on a particular port belongs to a particular device. That is port forwarding, and it is the one rule you write by hand. See opening a port.
Do not lean on NAT as your only defence. The moment you add IPv6, where every device has its own public address and there is no translation, the accident stops happening and only the firewall is left. That is why the firewall exists as its own thing. See firewall and NAT.
Double NAT
If your provider's box does NAT and your own router does NAT behind it, translation happens twice. Ordinary browsing does not care. Port forwarding does: you have to open the port on both boxes, and if you can reach only one of them, you are stuck. Some VPNs and game consoles complain too. The usual answer is to put the provider's box into bridge or modem mode so that your own router gets the public address.
CGNAT
Carrier grade NAT is the same trick, one level up. Instead of a public address, your provider gives you an address from a shared range and does the translation for hundreds of customers at once. It is common on mobile connections and increasingly on fixed ones.
Outgoing traffic works normally, so most people never notice. What you lose is reachability. You cannot forward a port, because the address is not yours. A VPN server at home will not accept connections. A dynamic DNS name points at an address you do not control.
How to recognise it: your router's WAN address starts with 100.64 through 100.127, or it is a private address, and it does not match what a "what is my IP" website shows you. What to do about it: ask your provider for a public address, which is often free or a few euros a month, or use a tunnel service that connects outwards from your network so that nothing has to come in. IPv6, when your provider offers it, sidesteps the problem entirely.
Where the tool picks this up
The configurator switches on the translation for you when you describe your internet connection in WAN, and anything you want to be reachable from outside you add in opening a port.