No NSG is required to allow the traffic flow via ExR. You try not to ping Public IP of the VNET gateway instead use layer 4 connectivity test like psping to the public IP on port 443.
Let me know if you have any questions.
Regards,
Karthik Srinivas