In the Datacentre (top-left) highlight Firewall and then Security Group.

Create security groups for:

• Your servers (all of them set to allow)
• The services you will use, e.g.:
  • Web (you will need this to get certificates from LetsEncrypt for your nodes, even if they don't have any web server VMs)
  • Mail

After you have Security Groups made, click on a node name in the left menu, then:

1. Click on Firewall
2. Click Insert Security Group
3. Add each of your Security Groups

In a terminal, SSH to the node and enable the firewall:

vim /etc/pve/firewall/cluster.fw

[OPTIONS]
enable: 1

[RULES]
... the rules that the GUI inserted ...

You may also configure firewalls on each VM later, in which case you will need to similarly enable them.

Reference: https://pve.proxmox.com/wiki/Firewall