So, at TCP level routing should allow ssh client to reach server. The session is secure (encrypted, authenticated) and logically allows multiple data pipes to b

So, at TCP level routing should allow ssh client to reach server. The session is secure (encrypted, authenticated) and logically allows multiple data pipes to be multiplexed of over the connection. By default, one pipe is used to connect client terminal to a remote shell at the server, but it's possible to do something useful with the other pipes. For instance, user local forwarding, as port or IP address only locally visible to the server can be tunneled through a pipe and mapped to a port on the client machine. So, in case of RDP: never expose port 3389 on a public IP. Instead use an SSH tunnel to route the RDP traffic through a tunnel over port 22 (or some random SSH port) and have it egress on the client's machine. Your RDP client can then transparently use the local port.