The diagram on this page shows all 3 sites using the same subnet, 192.168.0.0/24. Let's say on the hub site where 192.168.0.10 is the gateway interface and 192.168.0.11 is the bridge interface on the vpn server, there is a switch connected to 9 PCs 192.168.0.1–192.168.0.9 and the gateway and VPN server.
When one of these PCs wants to send to 192.168.0.25, if the PCs have a /24 netmask then it will deem it to be on the same subnet and therefore will send an ARP request for the MAC addr of the IP rather than targeting the default gateway; I'm guessing the reason why the sites are on the same subnet because the VPN server is separate from the router. Does the VPN server configure a proxy ARP for its connections so that it can reply to the ARP requests with its own MAC addr? How does the VPN server know what VPN server to tunnel 192.168.0.25 to? I'm assuming there's a tunneled routing protocol IBGP session set up between the VPN servers but surely both of the other VPN servers would advertise 192.168.0.x/24 of their bridge interface, so how does it know which VPN to send it to and that it's not destined to a local PC (seeing as the local bridge has the same subnet as well)?