1-to-1 NAT is for where you have multiple public IP's on a single interface. If you have a single public IP then, if the web server is running on ClearOS and ClearOS is your gateway, you want to open Incoming ports 80 and 443. If 172.16.0.3 is a machine on your LAN, you want to port forward instead. Do not do both at the same time. It does not work.

[edit]
I've deleted your other post as it was to a 7 year old thread.
[/edit]

If you only have 1 external IP Address but multiple internal webservers you want to address, you can also use the ProxyPass app from the marketplace. Then you can use your domains/subdomains for those internal webservers over 1 external IP. You can configure it from the webconfig.

What are you trying to do? Are you wanting to access two different websites on one webserver using the same ip address in your browser for both, rather than using the domain names?

Try not to over-complicate the firewall.

If you need to allow ClearOS to be your webserver, you should only use the 'Incoming Firewall Rules' ruleset. Adding 1:1 NAT is for extra IPs from your ISP and will only confuse your firewall if you only have the 1 IP address.

https://www.clearos.com/resources/documentation/clearos/content:en_us:kb_o_virtual_interfaces_dmz_port_forwarding_and_1-1_nat