You dont need to set up a VPN (assuming this is home connection or not a high security environment) just open port 3389 for inbound connections. Assuming you are patched etc then you should be fine ...