With a tunnel SSH, you can do something like that:
laptop Ubuntu server guest
____ 10467 22 _____ ? 3389_____
| |___________________| |__________| |
|____| \ |_____| |_____|
But take care that only the connection between laptop and Ubuntu server will be encrypted. And the port 3389 has to be opened so that's not what you're looking for. You should go with a VPN if you want to do RDP with a server reachable from Internet.
If the Ubuntu server is in the same protected Local Area Network (LAN) than windowsguest, then it's ok. You just have to open your 3389 port on windowsguest and close it on your firewall, so that it remains protected. Even if windowsguest is reachable from Internet, it won't use the same interface to communicate with the Ubuntu server and with the rest of the world. So, just make sure the 3389 port is closed on the Internet interface and open on the LAN interface.
openssh program, the commandline would look like
ssh -L 10467:windowsguest:3389 user@ubuntuhost.
The same option exists for PuTTY.
In this window:
- select "Local" option
- enter "windowsguest:3389" as destination
- enter "10467" as source port
- leave "Auto" option
This image was taken from http://howto.ccs.neu.edu/howto/windows/ssh-port-tunneling-with-putty/ which is a pretty good tutorial for port tunneling with SSH.