Set up port forwarding for port 3389 to client R10.
Configure the firewall to allow port forwarding from a single IP (33.44.55.66) only.
It should be possible to access HTTPS, SMTP and SMTP submissions, but not to other services, from anywhere.
Create a firewall ruleset and assign it to the default provider.