As Tom suggested in the comments, what you need to do is setup a static 1:1 NAT for your (I hope) DMZ'ed public-facing servers. Your source NAT (many-to-one likely) will allow your LAN subnet to NAT out as one of your /16 accordingly.
For example:
- LAN subnet: 192.168.0.0/24
- DMZ subnet: 192.168.1.0/24
- WAN subnet: 200.200.200.0/16
By setting up your LAN and your DMZ networks on separate subnets (whether you use VLANs or a separate interface on your firewall; it should have a "DMZ" or "Optional" interface), which are routed and filtered by your firewall, you can now setup 1:1 NAT to statically assign a DMZ address to a public address, but also have filtering setup to permit inbound traffic from the Internet and from your LAN (and vice-versa, say if one of your servers needs to talk to a Domain Controller internally) on only the ports and source IP addresses you wish.
To the rest of the world, your servers appear to be on the "outside", but they're really isolated to/from the Internet and to/from your LAN, improving security by allowing you to create inbound rules for Internet traffic but also outbound rules to say only permit a Webserver from accepting established inbound 80/443 connections, but not allowing it to initiate outbound connections to any TCP/UDP port (and thus adding a layer of defense against zombified botnet traffic, or spam bots, etc. should your Webserver because compromised).
If your servers are NOT behind your firewall, you get no benefit of firewalling, centralized firewall logging, etc. and that's not a Good Thing.