Go to configuration – > security policy

Add Access Rule

Interface: outside

Action: permit

Source: any

Destination: type in the public IP address, aka the outside interface IP address

Service: “tcp/PORT_NUMBER_HERE”

Click OK (maybe 2 times)

Click Apply

Then click on NAT on the left

Click on Add Static Nat rule

Under “Original”

Interface: Inside

Source: Internal ip address that you want traffic routed to

Under Translated

Interface: outside

Click the radio button that says “Use Interface IP Address”

Check the “Enable PAT” check box

TCP and set both ports to be what you want (i.e. 3389 for RDP)

This NAT part always seems backwards to me, but it works.