WCF- Custom username-password authentication for NETTCP duplex service in Console host

Question

I was searching about an example of custom userName/Password authentication for nettcp binding in wcf service and host it on a console application but I couldn't find anything. so I stated to write an example for myself.

I got this example and change it to use app.config. so I create this configuration file:

<system.serviceModel>
<behaviors>
  <serviceBehaviors>
    <behavior name="GroceryListDuplexBehaviors">
      <serviceMetadata httpGetEnabled="true" />
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom" 
                                customUserNamePasswordValidatorType="GroceryListDuplexServiceHost.MyValidator, GroceryListDuplexServiceHost"/>
        <serviceCertificate storeLocation="LocalMachine" storeName="My" 
                            x509FindType="FindBySubjectName" findValue="localhost"/>

      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>
<bindings>
  <netTcpBinding>
    <binding name="GroceryListDuplexBinding">
      <security mode="TransportWithMessageCredential">
        <transport clientCredentialType="None"/>
        <message clientCredentialType="UserName"/>
      </security>
    </binding>
  </netTcpBinding>

</bindings>
<services>
  <service behaviorConfiguration="GroceryListDuplexBehaviors" 
           name="ExampleDuplexServiceLibrary.GroceryListDuplexService">
    <endpoint address="net.tcp://localhost:9011/WCFServices/" binding="netTcpBinding"
              bindingConfiguration="GroceryListDuplexBinding" name="GroceryListDuplexService"
              contract="ExampleDuplexServiceInterface.IGroceryListDuplexService" />
    <endpoint binding="mexHttpBinding" bindingConfiguration="" name="GroceryListDuplexServiceMex" 
              kind="mexEndpoint" address="http://localhost:9001/WCFServices/mex" />
    <host>
      <baseAddresses>
        <add baseAddress="http://localhost:9001/WCFServices/" />
      </baseAddresses>
    </host>
  </service>
</services>

so I run the service on my local system and it run successful. then I create a test project and add that service with these configuration file:

<system.serviceModel>
  <behaviors>
    <endpointBehaviors>
      <behavior name="certificateEndpointBehavior">
        <clientCredentials>
          <serviceCertificate>
            <authentication certificateValidationMode="None" revocationMode="NoCheck"/>
          </serviceCertificate>
        </clientCredentials>
      </behavior>
    </endpointBehaviors>
  </behaviors>
    <bindings>
        <netTcpBinding>
            <binding name="GroceryListDuplexService">
                <security mode="TransportWithMessageCredential">
                    <message clientCredentialType="UserName" />
                </security>
            </binding>
        </netTcpBinding>
    </bindings>
    <client>
        <endpoint address="net.tcp://localhost:9011/WCFServices/" binding="netTcpBinding" behaviorConfiguration="certificateEndpointBehavior"
            bindingConfiguration="GroceryListDuplexService" contract="ServiceReference1.IGroceryListDuplexService"
            name="GroceryListDuplexService">
            <identity>
                <dns value="localhost" />
            </identity>
        </endpoint>
    </client>
</system.serviceModel>

The client run success in local machine but when i run client on a remote machine and want to connect to the service it get error.

The error is An unsecured or incorrectly secured fault was received from the other party. See the inner FaultException for the fault code and detail. and the inner exception is An error occurred when verifying security for the message.

My question is How can i create a duplex WCF service with nettcp binding and Custom username/password authentication and hosting it on a console application?