This is very easy to achive using the localforward of ssh:
Lets say you have a host GATEWAY and a host RDPSERVER which is reachable from GATEWAY. You want to give your user access to RDPSERVER:5900 when logged in on GATEWAY.
Users log in to GATEWAY using
ssh -N -L 33642:RDPSERVER:5900 user@GATEWAY
This opens a port 33642 on the users machine, which is transparently forwarded to RDPSERVER:5900. So, user can fire up an RDP viewer, point it to localhost:33642 and all data will be encrypted and tunneld to GATEWAY and from there to RDPSERVER.
Once the user is logged in, he can check that the connection is up using
telnet localhost 33642
If you need several services to possibly different hosts, just add more instances of the -L parameter
On unix hosts, it may be best to distribute a ssh config file with the parameters.
As you can see, ssh has great features (and there is much more than localforward, check out remoteforwards and dynamic port forwards).