@yehor Been there, done that (or rather, our students did)!
This is how we regained control:
Disconnect server from network/internet, then with a direct connection, SSH into the server controlling the cluster, or access the command line from your kvm terminal.
$ nano /etc/pve/firewall/cluster.fw
Change line: enable: 1 to enable: 0
Save and exit nano
$ pve-firewall restart
That’ll let you into the web interface again, where you can fix the rules and re-enable the firewall.
Good luck.