Conceptually, what you want is a local firewall rule that sends any TCP port 3389 traffic through your TUN/TAP interface, instead of your normal Ethernet interface (such as Local Area Connection).
In Linux, this is with some
iptables and route magic, but I don't know of any Windows-based firewall that can do this kind of port-based redirection (though admittedly, I'm certainly not an expert on the topic).
