Masquerading: All machines in your internal network appear at the same (set of) public addresses. I.e., you can have 8 public IP addresses, and a network of 200 machines with private addresses using them to go "outside". When a host inside wants to open a connection to the outside, the connection gets assigned an ID address and port from this pool. It was conceived as a way of conserving IPv4 addresses when it became clear they were going scarce, and then (ab)used as a security measure (any incomming connections are at the mercy of the machine doing the translating). This is usually called NAT (Network Address Translation), if there is just one public address it is more accurately called PAT (Port Address Translation, only ports are translated). But both are usually named NAT.
Port forwarding: All traffic directed at a certain IP address and port are sent to another address and port, any responses follow the reverse path. This is usually coupled with masquerading (i.e., outside accesses the HTTP or SMTP ports on one of the masquerading addresses, traffic to that port is handled by the internal machine offering that service). It can also be done if both the forwarder and its target have public addresses, but it is rather pointless.
Firewall: A machine filtering traffic between networks, typically an internal network and the Internet, but it could also separate two internal networks. The firewall inspects connection requests and/or flowing traffic, and denies traffic (or modifies it). Is usually combined with the above two.