diff --git a/netbox/vpn/migrations/0001_initial.py b/netbox/vpn/migrations/0001_initial.py
index 0e79e9061..e0753249c 100644
--- a/netbox/vpn/migrations/0001_initial.py
+++ b/netbox/vpn/migrations/0001_initial.py
@@ -1,4 +1,4 @@
-# Generated by Django 4.2.6 on 2023-11-07 21:49
+# Generated by Django 4.2.7 on 2023-11-15 19:50
 
 from django.db import migrations, models
 import django.db.models.deletion
@@ -11,10 +11,10 @@ class Migration(migrations.Migration):
     initial = True
 
     dependencies = [
-        ('tenancy', '0011_contactassignment_tags'),
-        ('extras', '0099_cachedvalue_ordering'),
         ('contenttypes', '0002_remove_content_type_name'),
+        ('tenancy', '0011_contactassignment_tags'),
         ('ipam', '0067_ipaddress_index_host'),
+        ('extras', '0099_cachedvalue_ordering'),
     ]
 
     operations = [
@@ -88,7 +88,11 @@ class Migration(migrations.Migration):
             options={
                 'verbose_name': 'tunnel termination',
                 'verbose_name_plural': 'tunnel terminations',
-                'ordering': ('tunnel', 'pk'),
+                'ordering': ('tunnel', 'role', 'pk'),
             },
         ),
+        migrations.AddConstraint(
+            model_name='tunneltermination',
+            constraint=models.UniqueConstraint(fields=('interface_type', 'interface_id'), name='vpn_tunneltermination_interface', violation_error_message='An interface may be terminated to only one tunnel at a time.'),
+        ),
     ]
diff --git a/netbox/vpn/models/tunnels.py b/netbox/vpn/models/tunnels.py
index f6bb77dfd..b07ac3ab4 100644
--- a/netbox/vpn/models/tunnels.py
+++ b/netbox/vpn/models/tunnels.py
@@ -1,4 +1,4 @@
-from django.contrib.contenttypes.fields import GenericForeignKey
+from django.contrib.contenttypes.fields import GenericForeignKey, GenericRelation
 from django.db import models
 from django.urls import reverse
 from django.utils.translation import gettext_lazy as _
@@ -107,7 +107,14 @@ class TunnelTermination(CustomFieldsMixin, CustomLinksMixin, TagsMixin, ChangeLo
     )
 
     class Meta:
-        ordering = ('tunnel', 'pk')
+        ordering = ('tunnel', 'role', 'pk')
+        constraints = (
+            models.UniqueConstraint(
+                fields=('interface_type', 'interface_id'),
+                name='%(app_label)s_%(class)s_interface',
+                violation_error_message=_("An interface may be terminated to only one tunnel at a time.")
+            ),
+        )
         verbose_name = _('tunnel termination')
         verbose_name_plural = _('tunnel terminations')