If got locked out, edit the file /etc/pve/firewall/cluster.fw and put “0”

“Datacenter” firewall effects everything. Everything else is FOR THEMSELVES. A rule in pve1 won’t effect any VM. You have to define specific to VM.