NAT port rule?

I have a Untangle 10.1 router with 4 NICs. All 3 internal subnets are NAT'd with option NAT traffic coming from this interface (bridge peers) as per below. I am needing for 1-2 IPs from the Internal network to RDP (3389) to a single IP in the guest subnet. That is all the traffic I want to allow between them and would prefer not to go externally to access. I obviously don't know how to do this as I've tried port forwards, firewall rules, NAT and forward filter rules. Can someone tell me what I'm doing wrong and how best to configure this?

Internal 10.0.100.0/24
Lab 192.168.8.0/24
Guest 172.16.176.0/24


Thank you for your help,

Ctopher