You need to initiate the VPN connection at your gateway, which is the device that provides your internet connection.
Entry-level and home devices generally don't permit this, so you'll need a mid-level device, or flash your device with a new firmware if you can (such as tomato or dd-wrt). There are also entire OS's dedicated to firewalling that you could put in-front of your router to use as your default gateway such as PFSense (Unix & Free), or Microsoft TMG (Windows, not free). All server OS's can also do this (Linux - iptables and pptpd, and for Windows Server RRAS).
Depending on the support of your firmware, you will then create the VPN connection to your host. A lot of modern routers have dropped support for PPTP tunnels (too insecure? not sure why), so you need to use L2TP or IPSec. This will depend entirely on your device. If you're using OpenVPN you might be out of luck.
If the destination network is on a different subnet to your local network (you better pray it is), then routing rules will be created automatically on the router to send all VPN traffic over the VPN link. So, then you probably (read: definately) want to lock down the source and destination networks and protocols that can run over the VPN.
So you would want to lock VPN traffic down to:
- Source: IP Addresses of those 10 machines
- Destination: IP Address of the RDP server
- Port: 3389 (RDP)
- Action: Permit
And then a final rule:
- Source: All
- Destination: Entire IP range of the destination VPN
- Port: All
Action: Deny
