Strictly technically speaking, you can configure almost any role on any server. But not every such deployment is considered a good practice.
Especially with a bigger deployment the CM is already a relatively "well-stressed" member of your environment (it has enough to do on its own without adding additional roles) so that while you can do that you should rather find another component to "colocate" the LM role.
Anyway, the "connection timeout" messages typically indicate network-level issues - somewhere the traffic is getting filtered on firewall (or you have routing problems).
