It sounds like your firewall / router device doesn't support "NAT hairpin". When the users attempt to access the RDP server while on the LAN the server's name is being resolved, by DNS, to the external-side IP address of your firewall. The PC's RDP connection attempt is being sent to the firewall which isn't routing it back to the server on the LAN.
The easiest "fix" for you would be to:
Install the DNS Server role on the Windows Server machine (or another Windows Server machine, if you have one)
Create a "Forward Lookup Zone" with the same name being used by users to access the RDP server
Create an "A" record in this zone with a blank hostname and resolving to the LAN IP address of the RDP server computer
Reconfigure your DHCP server to provide the IP address of the server you installed the DNS Server role as the DNS server for client computers
If you're using the "bare" domain name "domain.com" to access your RDP server you'll find that the technique above will "break" access to Internet sites using your domain (like "www.domain.com"). In that case it would be better to create a DNS record on the Internet for something like "RDP.domain.com" (and the same Forward Lookup Zone on your LAN) so queries for other "domain.com" names can be sent to your Internet DNS server.
Finally, if you're going to expose a Windows Server machine directly to the Internet with RDP please be sure that your users are using complex passwords (that, hopefully, they're not using in other places), implement the Windows Account Lockout policy to disable accounts after consecutive failed logon attempts, and consider rate-limiting new incoming RDP connections to the server with your firewall (or, a third-party script