Changing from WSDualHttpBinding to NetTcpBinding doesn't seem to work - wcf

Question

I have a client-server application. I have been using WsDualHttpBinding for callbacks and all is well. The WCF service uses x509Certificates. The app will be hosted within the org's intranet. I have opted to configure NetTcpBinding on a dedicated port. The WCF Service runs on NetworkService and accesses MSSQL Server DB on login NetworkService.
The Wcf services are hosted on a website in IIS.
The app.config for the client looks like this
<configuration>
<system.net>
<connectionManagement>
<remove address="*" />
<add address="*" maxconnection="200" />
</connectionManagement>
</system.net>
<system.serviceModel>
<behaviors>
<endpointBehaviors>
<behavior name="certForClient">
<CustomBehaviorExtension />
<clientCredentials>
<serviceCertificate>
<authentication certificateValidationMode="None" revocationMode="NoCheck" />
</serviceCertificate>
<clientCertificate findValue="localhost" x509FindType="FindBySubjectName" storeLocation="CurrentUser" storeName="My" />
</clientCredentials>
<dataContractSerializer maxItemsInObjectGraph="2147483647" />
</behavior>
</endpointBehaviors>
</behaviors>
<bindings>
<netTcpBinding>
<binding closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
transactionFlow="true" transferMode="Buffered" transactionProtocol="OleTransactions"
hostNameComparisonMode="StrongWildcard" listenBacklog="3000" maxBufferPoolSize="2147483647"
maxBufferSize="2147483647" maxConnections="1500" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647"
maxBytesPerRead="2147483647" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="20:00:10" enabled="true" />
<security mode="Message">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</netTcpBinding>
</bindings>
<client>
<endpoint address="net.tcp://localhost/Service1.svc"
binding="netTcpBinding"
contract="SampleWCFProxy.IService1"
behaviorConfiguration="certForClient">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
<endpoint address="net.tcp://localhost/Service2.svc"
binding="netTcpBinding"
contract="SampleWCFProxy.IService2"
behaviorConfiguration="certForClient">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
</client>
</system.serviceModel>
</configuration>
The web.config looks like this
<configuration>
<system.net>
<connectionManagement>
<remove address="*" />
<add address="*" maxconnection="200" />
</connectionManagement>
</system.net>
<system.serviceModel>
<bindings>
<netTcpBinding>
<binding closeTimeout="00:01:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:01:00"
transactionFlow="true" transferMode="Buffered" transactionProtocol="OleTransactions"
hostNameComparisonMode="StrongWildcard" listenBacklog="3000" maxBufferPoolSize="2147483647"
maxBufferSize="2147483647" maxConnections="1500" maxReceivedMessageSize="2147483647">
<readerQuotas maxDepth="32" maxStringContentLength="2147483647" maxArrayLength="2147483647"
maxBytesPerRead="2147483647" maxNameTableCharCount="16384" />
<reliableSession ordered="true" inactivityTimeout="20:00:10" enabled="true" />
<security mode="Message">
<transport clientCredentialType="Windows" protectionLevel="EncryptAndSign" />
<message clientCredentialType="UserName" algorithmSuite="Default" />
</security>
</binding>
</netTcpBinding>
</bindings>
<behaviors>
<behavior name="ApplicationFaults">
<ApplicationBehaviorExtension />
<CustomBehaviorExtension />
</behavior>
</endpointBehaviors>
<serviceBehaviors>
<behavior name="MyServiceBehavior">
<serviceCredentials>
<serviceCertificate findValue="localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectName" />
</serviceCredentials>
<serviceSecurityAudit auditLogLocation="Application" serviceAuthorizationAuditLevel="Failure" messageAuthenticationAuditLevel="SuccessOrFailure" />
<dataContractSerializer maxItemsInObjectGraph="2147483647" />
<serviceThrottling maxConcurrentCalls="1500" maxConcurrentSessions="1500" maxConcurrentInstances="1500" />
</behavior>
<behavior name="">
<serviceMetadata httpGetEnabled="false" />
<serviceDebug includeExceptionDetailInFaults="true" />
</behavior>
</serviceBehaviors>
</behaviors>
<services>
<service behaviorConfiguration="MyServiceBehavior" name="SampleWCF.Services.Service1">
<endpoint address=""
binding="netTcpBinding"
contract="SampleWCF.Services.Contracts.IService1">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
<endpoint address="mex" binding="mexTcpBinding" contract="IMetadataExchange" />
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:7860/Service1" />
</baseAddresses>
</host>
</service>
<service behaviorConfiguration="MyServiceBehavior" name="SampleWCF.Services.Service2">
<endpoint address=""
binding="netTcpBinding"
contract="SampleWCF.Services.Contracts.IService2">
<identity>
<dns value="localhost" />
</identity>
</endpoint>
<endpoint address="mex" binding="mexTcpBinding" contract="IMetadataExchange" />
<host>
<baseAddresses>
<add baseAddress="net.tcp://localhost:7860/Service2" />
</baseAddresses>
</host>
</service>
</services>
</system.serviceModel>
</configuration>
The IIS end looks like this
I have looked at related posts for configurations but none seem to work.
From this situation, these questions arise:
What am I doing wrong?
Which user should be used to access the database by the application pool?