Which role will the Windows firewall check against the tunneled data?

By running an SSH tunnel to a windows remote server connection as described in the following links-

http://ift.tt/1aarFIg

http://ift.tt/1F99Ao6

And assuming my local port for the operation is 3390 (typing "localhost:3390" in my remote server connection program at the client side), and assuming I have the tunnle forwarded to 1.1.1.1:3389 and I run the sshd process on port 22, What rules will be checked by the server's firewall?

rule of port 22 for the packet that arrive to the sshd process? port 3389 for the data arrive to the server's remote connection process? both?

In case the firewall will check the data against the rule of port 22, I could disable the roles allowing incoming data to the server's port 3389, i.e not allowing regular remote desktop connection thus allowing only SSH tunneled connections, which is my whole intention.