I need to put an old 2003 Terminal Server behind a Mikrotik router. The idea is to enable VPN in, thus securing the old server.

What I would like to do is to enable clients to use RDP protocol over VPN, so they don't leach on my rather weak 20MBPS link.

Any ideas what should I do? Thanks!

Add in a firewall rule to block anything except RDP port (!3389 maybe?) over the VPN interface. Should sort it for you.