SSH port forwarding through Windows machine

I think this is a pretty secure setup, I use it myself. You will need to add '-L' to your command:

ssh -N -L 8888:targethost:80

As long as you don't use the '-g' option, only your client machine can access the port forward.

What I would recommend also is to make sshd on the bastion host listen on a non-standard port. If you are listening on a standard port, the attack traffic sometimes can eat up considerable amounts of CPU.

Also choose a good passphrase for your ssh key, and enter it only on trusted machines. Preferably Linux, it is less trivial to install keyloggers on Linux.

Assuming your linux box is accessible from the internet at 1.2.3.4 on port 23008, on an external system I would do:

external% ssh -p 23008 -L 13389:192.168.8.y:3389 username@1.2.3.4

I'd then connect to the port-forwarded RDP system with

external% rdesktop localhost:13389

If your external box isn't a linux box, there will be equivalent commands for the tools you have; the idea is still the same: to forward external's port 13389 to 192.168.8.y's port 3389, then use external's RDP client to connect to localhost:13389.

You refer to setting up the linux box's sshd correctly, but unless you've reconfigured it, the standard sshd setup is likely to support this just fine.