Windows 2012 R2 Firewall Blocking Remote Desktop

I have the port 3389 incoming rule setup, but I cannot RD from a box in the public zone.  My machine is not actually public (it is on my internal LAN), but it is recognized by Windows 2012 R2 as public.

I have the standard Remote Desktop (TCP-In) incoming rule setup.  I can remote desktop fine if I only turn on the firewall for Private and Domain.  If I make the Public firewall zone active (i.e., ON), I immediately drop my RD connection.

I've tried to troubleshoot with no luck.  The target box is a VMware VM but I don't know why that would matter.

Thanks!