IPsec NAT Rule help

[opnsensef8]

Hello,

we do have an IPsec Tunnel that works as expected. "External" subnet 192.168.149.0/24 is linked to an internal IP 192.168.19.5. Host 192.168.19.5 must be redirected via RDP (3389) to an internal "real" host 192.168.10.8. Packets from 192.168.149.x are shown ion the foirewall Log and access to 192.168.19.5 is granted. But the RDP application stops after a timeout, so it seems as if the NAT 192.168.19.5:192.168.10.8 is not working.

Right now NAT is configured like this

NAT as portforwarding: everything that comes from interface IPsec and source 192.168.149.0/24 going to destination 192.168.19.5 port TCP/UDP 3389 NAT to 192.168.10.8 Port 3389.

Is there something that I forgot? Do we need to make the 192.168.19.5 "active"? Right now it is a "dead" IP within the NAT configuration.