But when I try to telnet into the open port on the pi, the connection is refused:
pi@EMK-RPiBv1:~$ telnet localhost 6566 Trying ::1... Connected to localhost. Escape character is '^]'. Connection closed by foreign host.
But, um, it's not refused. If it was, you would see "Connection refused". But it clearly says "Connected" here – the connection was accepted, and then closed by the actual service.
Anyway: I can guess at two problems:
With inetd-like socket activation such as this, the saned service isn't running until a connection is attempted. Therefore it cannot appear in scan results either (since it's not running during the scan). So instead you might need to run it as a permanent service, not a socket-activated one.
Your
saned.service
is not a real systemd service; it was automatically converted from /etc/init.d/saned (as the "LSB:" prefix shows). As the init.d conversion needs to handle many weird edge cases, sometimes it results in services that are barely working – especially when combined with socket activation. Thus you should avoid starting saned's native-systemd units and LSB-converted units at the same time.