OK, I got it figured out after lots of reading through the forum.
Disable port-based VLAN.
Enable 802.1Q VLAN.
For any port that will have traffic that's not tagged with a VLAN, set it up as ACCESS and the VLAN it should be tagged with.
For any port that will act as passthrough for VLAN tagged traffic, set it up as TRUNK and add the allowed VLANs.
The "action" pulldown is the action you want to happen when you click APPLY, not the action you want the switch to take on each packet.
So....
To add VLAN 8 as a passthrough to eth4, select TRUNK, TAGGED ONLY, ACTION ADD, VLAN 8. This will add VLAN 8 to the allowed VLANs on eth4. It will leave any other allowed VLANs on the trunk, so to delete VLAN 8, select TRUNK, TAGGED ONLY, ACTION REMOVE, VLAN 8
Confusing, yes, but simple once you figure it out,.