#on Jump (note, I just found out that the iptables is redundant, ssh tunneling does enough)
iptables -t nat -A PREROUTING -p tcp --dport 3389 -j DNAT --to-destination <localRDP_IP>:3389
iptables -t nat -A POSTROUTING -p tcp -d <localRDP_IP> --dport 3389 -j SNAT --to-source <jumpIP>

#on client computer, connect via ssh (I use mobaxterm)
ssh -p 2022 -L 9389:<localRDP_IP>:3389 user@<publicIP>

#all that is needed
ssh -p <ssh port of anyIPonRDPIP_Net>  -L 9389:<localRDP_IP>:3389 user@<anyIPonRDPIP_Net>

#then rdp into 127.0.0.1:9389