Вход по RDP 
1)
Firewall > Rules > WAN
[src: * ][src port: * ] [dest: WAN ip ][dest port: 3389 (или др)]
На Lan
[src WAN IP][src Port *][dest TermSRV IP][dest port 3389]

2)
Firewall > NAT > Port Forward
[src addr: * ][src port: * ] [Dest. addr: WAN address ][Dest port: 3389 (или др)]
[Nat IP: Local IP ][NAT Ports: 3389 (или др)]

Внутри правила сделать так:
NAT reflection: Use sustem default
Filter rule association: Create new associated filter rule