For an explanation of masquerading, see
Re: What's the Secret?
DNAT is used to associate a "real" IP address with a private number. You can't access IP addresses that begin with 192, 172, 10 (so called "private" numbers)
directly from the Internet (well you could, but all the routers of the Internet are not
supposed to, because everybody agrees to abide by this rule, or Internet standard). So if you are using such numbers on your LAN, DNAT on a router (or routing firewall) translates all packets from a non-private (or 'real') address (that is, one
not starting with 192, 172, 10...) to a private one on your LAN...