>> from the same machine I then tried to ping >> 172.16.12.200 and I got nowhere. When I deleted the >> rule it worked fine. > > What machine has 172.16.12.167? Usually you should SNAT only to > address that is assigned to the machine/interface where you SNATing. Try to read into ProxyARP. It will give you some insights as to why what you describe doesn't work without either proxyARP or the IP address bound to your network card.
