Firewall disabled by default?

[Interceptor]

I did wonder that my phone (PBX VM) did not work.
The VM firewall was off and then i found out there is also i firewall on the node.
It was on, but pve-docs/chapter-pve-firewall.html#pve_firewall_cluster_wide_setup says:

The firewall is completely disabled by default.
If you want to administrate your Proxmox VE hosts from remote, you need to create rules to allow traffic from those remote IPs to the web GUI (port 8006). You may also want to allow ssh (port 22), and maybe SPICE (port 3128).

Here it was on after the installation and GUI, ssh and SPICE did work?

 

[dcsapak]

there is also the firewall checkbox on the datacenter level, that should be off by default and then the node firewall setting is ignored

 

[Interceptor]

Yes it says "no"
But VoIP was not working with the node firewall on...