Use the PuTTY SSH windows client to do this. http://www.chiark.greenend.org.uk/~sgtatham/putty/
Open PuTTY, enter the destination address (your outside RouterOS ip address), but do NOT click the "Open" button to connect yet.
In the left options tree go to "Connection => SSH => Tunnels", enter "8291" in the "Source port" field. Then type "172.20.20.252:8291" in the "Destination" field. And make sure you click the "Add" button.
Now start your SSH connection (click "Open" in the lower right part of the PuTTY window).
After you have successfully authenticated your SSH session, you can start your WinBox, type in "localhost" in the Connect to: field with the correct username/password of your nat'd machine to log in with WinBox (tunneled via your SSH connection).